A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Critical 10.0
CVE-2026-109110
Wavlink WL-WN592AX6 — command injection.
A flaw has been found in Wavlink WL-WN592AX6 250422.
Published Updated Source NVD
CVSS 3.1
10.0
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploit chance, 30 days
2.0%
Higher than 81% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run Wavlink WL-WN592AX6, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited
Other CVEs from Wavlink
25 more CVEs
10.0Wavlink WN551X3-A — command injection.EPSS 2.0%10.0Wavlink WN551X3-A — command injection.EPSS 2.0%10.0Wavlink WN536AX6-A — buffer overflow.EPSS 0.6%9.9Wavlink WN536AX6-A — command injection.EPSS 1.7%10.0Wavlink WN536AX6-A — command injection.EPSS 2.0%10.0Wavlink WN536AX6-A — command injection.EPSS 2.0%