External risk intelligence

Wavlink WL-WN592AX6 Daemon OS Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-109110

The affected product is a Wavlink router (WL-WN592AX6), which is a network infrastructure device. Such devices are designed to be internet-facing by default to provide gateway services, and the identified vulnerability in the system daemon can be triggered remotely, making it a highly exposed, public-facing component in standard deployment patterns.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the system software of certain Wavlink routers, specifically within the 'wmapd Daemon' component. This flaw allows for remote command injection, meaning an attacker could potentially execute arbitrary commands on the affected device without any user interaction. An exploit for this vulnerability has been published, increasing the risk of its exploitation.

Flaw allows remote command execution on routers.
Important for network infrastructure security.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a vulnerability in the Wavlink WL-WN592AX6 by remotely sending a specially crafted input to the 'wmapd' daemon. This manipulation allows the attacker to execute arbitrary operating system commands, potentially leading to a full system compromise. The exploit for this vulnerability has been published.

Requires no authentication or user interaction.
Triggers via remote input to a system daemon.
Allows OS command injection.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could exploit a command injection flaw in the Wavlink WL-WN592AX6's system component. This may allow an attacker to execute arbitrary operating system commands on the affected device.

System data and service behavior.
Remotely triggered via network.
Full system compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Wavlink WL-WN592AX6, affecting its system daemon and enabling remote OS command injection, necessitates immediate action. Given its nature as a network device likely exposed to the internet, infrastructure and network security teams are primarily responsible for identifying affected devices, assessing their reachability and business criticality, and coordinating remediation. The first practical step involves locating all instances of this device, confirming their exposure, and determining the accountable owner before planning a risk-based response, which may involve vendor engagement.

Infrastructure and security teams own this.
Verify device reachability and business impact.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Wavlink WL-WN592AX6?

The Wavlink WL-WN592AX6 is a wireless networking device, specifically a router, designed to manage home or office traffic. It acts as a gateway between local devices and the wider internet, using the wmapd daemon to handle system-level background processes for its core connectivity functions.

How does CVE-2026-109110 allow command injection?

This vulnerability, classified as CWE-77 and CWE-78, occurs when the router's wmapd daemon improperly validates input. By sending specially crafted network data to the device, an attacker can trick the system into running unauthorized operating system commands, effectively bypassing the software's intended restrictions.

When can an attacker trigger this command injection?

The vulnerability is triggered by sending malicious network input directly to the wmapd daemon. Because this flaw exists in a fundamental system component, it does not require the attacker to be authenticated or rely on a user clicking a link; however, the attack must reach the device's network services to succeed.

Is my device at risk per Halo Surface Signal?

Yes, if you use the Wavlink WL-WN592AX6, Halo Surface Signal flags this as high priority. Because the router is designed to be internet-facing to provide gateway services, the wmapd daemon is often directly accessible from the network, making it a highly exposed target for remote exploitation.

What should I do to secure my router?

Begin by creating an inventory of all deployed WL-WN592AX6 devices to understand their network placement. Determine if any units are directly reachable from the internet, then prioritize securing those specific assets while coordinating with the vendor to monitor for available firmware updates or further security guidance.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.