CVE-2026-109110

Summary

A remote OS command injection vulnerability exists in Wavlink WL-WN592AX6 access point firmware, allowing attackers to execute arbitrary commands on the device through the wmapd daemon's system function. This critical flaw enables full device compromise without requiring authentication.

Exploitability

The exploit is highly practical with no authentication required, leveraging remote network access to trigger command injection in the wmapd daemon's system function.

Blast radius

Exploitation could lead to complete device takeover, enabling attackers to execute arbitrary commands, potentially allowing lateral movement and persistent access to the affected wireless network infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 250422 or later, as this is the specific fixed version mentioned in the vulnerability description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.