Description
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Published: 2026-10-13
Score: 10 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in the wmapd daemon of the Wavlink WL‑WN592AX6 enables an attacker to inject operating system commands. Exploiting the injection can give the attacker full control over the device, allowing arbitrary execution of commands with the daemon’s privileges. The weakness is a classic OS command injection flaw, classified as CWE‑77 and CWE‑78, and can leak sensitive configuration data or lead to a full compromise of the device.

Affected Systems

The affected system is the Wavlink WL‑WN592AX6 router running firmware version 250422. No other products or versions are listed as vulnerable in the source material.

Risk and Exploitability

The CVSS score of 10 classifies the vulnerability as critical and the vendor acknowledges the flaw, but the EPSS score is not available and the issue is not in the CISA KEV catalog. An attacker can launch the exploit remotely, and code has already been published, indicating that attackers with minimal effort could compromise the device if it is exposed to untrusted networks.

Generated by OpenCVE AI on October 13, 2026 at 09:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware update from Wavlink that patches the wmapd daemon command injection flaw.
  • Restrict or disable the wmapd service or its management interface so that it is not reachable from external networks.
  • Block remote access to the WL‑WN592AX6 by using firewall rules or network segmentation to isolate the device from untrusted traffic.

Generated by OpenCVE AI on October 13, 2026 at 09:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 08:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Title Wavlink WL-WN592AX6 wmapd system os command injection
First Time appeared Wavlink
Wavlink wl-wn592ax6
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:wavlink:wl-wn592ax6:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wl-wn592ax6
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Wavlink Wl-wn592ax6
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T08:00:15.817Z

Reserved: 2026-10-12T08:33:00.911Z

Link: CVE-2026-109110

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-13T09:17:15.370

Modified: 2026-10-13T09:17:15.370

Link: CVE-2026-109110

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T09:30:13Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')