A critical, remotely exploitable OS command injection flaw in the wmapd daemon of the Wavlink WL-WN592AX6 (firmware 250422) has a publicly released exploit and no patch listed in the supplied records.
What Is It
CVE-2026-109110 is an OS command injection vulnerability (CWE-77, CWE-78) in the system function of the wmapd Daemon component of the Wavlink WL-WN592AX6. Manipulating input to this function can lead to arbitrary OS command execution. VulDB acted as the CNA and published the record on 2026-10-13. NVD currently lists its status as Deferred.
Why It Matters
The CNA rates this flaw as critical under all three CVSS versions it scored. CVSS 3.1 and 2.0 give the maximum score of 10.0, and CVSS 4.0 gives 9.3:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity marked as Proof-of-Concept
- CVSS 2.0: 10.0
The vectors show an attack that works over the network, has low complexity, and needs no privileges or user interaction. Confidentiality, integrity and availability impacts are all high, and the scope is changed. According to the advisory, "the exploit has been published and may be used."
This CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation. Still, a public exploit plus unauthenticated network access could lower the bar for attacking exposed devices. How much real-world risk this creates depends on how many devices are reachable and how reliable the published exploit is. The supplied data covers neither.
What's Vulnerable
| Vendor | Product | Component | Affected Version |
|---|---|---|---|
| Wavlink | WL-WN592AX6 | wmapd Daemon | 250422 |
The supplied data names only firmware version 250422 as affected. It does not say whether other versions are affected.
Patch Status
The supplied NVD and KEV data list no patch, fixed version or vendor advisory. The advisory says the vendor "was contacted early about this disclosure" but does not mention a vendor response. Because the CVE is not in KEV, there is no CISA-mandated required action or due date.
Owners of affected devices should watch Wavlink for a firmware update. Until one ships, they should keep the device's management and service interfaces off untrusted networks.