EXPOSURES › CVE-2026-109110
CVE-2026-109110
CRITICALWavlink WL-WN592AX6 router's wmapd daemon allows remote OS command injection via unpatched flaw.
The wmapd daemon in Wavlink WL-WN592AX6 routers permits remote OS command injection, enabling attackers to execute arbitrary commands on the device. DIB organizations must patch this critical flaw immediately to prevent remote compromise of network infrastructure, which could lead to lateral movement or data exfiltration. The exploit is published and actively usable, making this a high-priority remediation target.
Shame score — A critical remote OS command injection flaw in a consumer router was left unpatched long enough for an exploit to be published and used in the wild, demonstrating negligent vulnerability management.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.