Vulnerability · Published Oct 13, 2026 · Assigned by VulDB
CVE-2026-109110Wavlink WL-WN592AX6 wmapd system os command injection
Critical 10.0
In plain English
A critical-severity OS command injection in WL-WN592AX6 from Wavlink. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)2.0%top 18.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Wavlink | WL-WN592AX6 | 250422 |
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C
References
- VDB-416861 | Wavlink WL-WN592AX6 wmapd system os command injection vdb-entry, technical-description
- VDB-416861 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-109110 | CVE Analysis and Report third-party-advisory
- Submit #913573 | Wavlink WL-WN592AX6 M92AX6AI_V250422 OS Command Injection third-party-advisory
- https://drive.google.com/file/d/1KtZZ7kjVswRgP2VLEx7M7gEafyY8Wp2Q/view?usp=drive_link exploit