Description
A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Published: 2026-10-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via remote NULL pointer dereference
Action: Apply Patch
AI Analysis

Impact

The flaw lies in the main function of the device’s /cgi-bin/upload.cgi executable; by manipulating the Cookie HTTP header, an attacker can trigger a null pointer dereference, causing the process that handles the request to crash. The crash is a remote denial of service; the CVE description does not confirm arbitrary code execution, so the impact is limited to service disruption rather than full compromise.

Affected Systems

Devices of model Wavlink WL‑WN592AX6 running firmware 250422 are affected. This covers all units identified by the CNA as WL‑WN592AX6 with the listed firmware version.

Risk and Exploitability

The CVSS score of 6.9 places the vulnerability in the Medium range. No EPSS score is recorded, and the issue is not listed in the CISA KEV catalog, indicating limited known exploitation. The attack vector is network‑based; an attacker can send a crafted Cookie header to /cgi-bin/upload.cgi from any remote location. The resulting null pointer dereference terminates the web service, which can be leveraged for repeated denial of service or used as a preliminary step to attempt further attacks if additional weaknesses exist.

Generated by OpenCVE AI on October 13, 2026 at 08:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the WL‑WN592AX6 firmware to the latest vendor release that includes the null pointer dereference fix.
  • If a patch is unavailable, restrict access to /cgi-bin/upload.cgi behind a firewall or to trusted IP ranges, or disable the upload feature entirely until a fix is applied.
  • Configure a watchdog or similar mechanism to automatically restart the web service if it crashes, thereby reducing the impact of the denial of service attack.

Generated by OpenCVE AI on October 13, 2026 at 08:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Title Wavlink WL-WN592AX6 upload.cgi main null pointer dereference
First Time appeared Wavlink
Wavlink wl-wn592ax6
Weaknesses CWE-404
CWE-476
CPEs cpe:2.3:a:wavlink:wl-wn592ax6:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wl-wn592ax6
References
Metrics cvssV2_0

{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Wavlink Wl-wn592ax6
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T13:18:30.048Z

Reserved: 2026-10-12T08:32:50.748Z

Link: CVE-2026-109107

cve-icon Vulnrichment

Updated: 2026-10-13T13:18:19.401Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T08:16:59.680

Modified: 2026-10-13T14:17:25.117

Link: CVE-2026-109107

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T19:15:14Z

Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release

  • CWE-476

    NULL Pointer Dereference