CVE-2026-109110 — Wl-Wn592ax6
CRITICALCVE-2026-109110 is a critical-severity (CVSS 10) CWE-77 vulnerability in wavlink wl-wn592ax6. No vendor fix is recorded yet; mitigation options are listed below.
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection.…
Description
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Affected Products
wl-wn592ax6wavlinkDetection & mitigation playbook
Vendor / applianceDetect
Inventory every wavlink wl-wn592ax6 deployment and check each version against the affected-products list above.
Remediation status
No patch has shipped for CVE-2026-109110 yet — track the wavlink wl-wn592ax6 advisory for a fixed release and apply the workarounds below in the meantime.
Mitigate without a patch
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-109110 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.