Critical OS Command Injection Flaw Found in Wavlink WL-WN592AX6 Router Firmware
The National Vulnerability Database lists a critical OS command injection flaw in Wavlink router firmware, noting that the exploit has been published and the vendor was notified early.
Key points
- CVE-2026-109110 carries a CVSS score of 10, indicating a critical severity level for remote attackers.
- The vulnerability stems from OS command injection in the wmapd Daemon component of the router's system function.
- The exploit has been published and may be used, affecting Wavlink WL-WN592AX6 devices running firmware version 250422.
The National Vulnerability Database (NVD) has published a record for CVE-2026-109110, a critical security flaw affecting Wavlink wireless routers. This vulnerability allows remote attackers to perform OS command injection on affected devices through a manipulation of the wmapd Daemon component. The issue is present in firmware version 250422 of the WL-WN592AX6 model.
At a glance
- CVE
- CVE-2026-109110
- Product
- Wavlink WL-WN592AX6
- CVSS
- 10 Critical
- Weakness
- OS command injection
- Exploited
- No known exploitation
The NVD assigns this vulnerability a CVSS score of 10, the highest possible rating, classifying it as critical. The flaw is categorized under CWE-78 and CWE-77, which relate to OS command injection weaknesses. According to the database entry, the exploit has been published and may be used by threat actors to compromise targeted systems remotely.
Context and Background
The vulnerability resides within the wmapd Daemon, a component of the system function on the device. The NVD record states that executing a manipulation against this component leads to OS command injection. This type of flaw allows an attacker to inject commands that the operating system executes.
The vendor was contacted early about this disclosure, according to the NVD record. The record notes that the exploit has been published and may be used. Security professionals should treat this as a significant risk for any unpatched installations of the affected firmware, given the critical severity rating and remote nature of the attack.
Who Is Affected
Only Wavlink WL-WN592AX6 routers running firmware version 250422 are confirmed to be affected by CVE-2026-109110. The NVD record specifically identifies this model and version string in its affected products list. Other Wavlink models or different firmware versions are not mentioned in the current advisory. Users of this specific hardware configuration are at risk of remote exploitation if the device is exposed to untrusted networks.
What should you do?
No patch, fix, or update has been confirmed yet for this vulnerability. The NVD record does not mention a remediation or a new firmware release. Users should assume the risk remains active until the vendor provides an official update. Network administrators should monitor for unusual activity from these devices, as remote command injection can lead to unauthorized control.
What to do and how to stay safe: Wavlink
- Isolate affected Wavlink WL-WN592AX6 routers from the internet if you cannot verify their firmware version or patch status.
- Monitor network logs for unusual commands or traffic originating from the router, which may indicate exploitation of the wmapd Daemon.
- Check for any official announcements from Wavlink regarding a firmware update that addresses CVE-2026-109110 before restoring full internet access.
- Ensure that administrative interfaces for the router are not accessible from public networks to reduce the attack surface for remote exploitation attempts.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-109110?
The National Vulnerability Database lists the CVSS score for CVE-2026-109110 as 10, which is classified as critical severity.
Which specific Wavlink devices are affected by this flaw?
The vulnerability affects Wavlink WL-WN592AX6 routers specifically when running firmware version 250422.
Is there a patch available for this vulnerability?
No fix has been confirmed yet. The NVD record states the vendor was contacted early, but does not mention an available update.
