CVE-2026-109107

Executive Summary

CVE-2026-109107 is a null pointer dereference vulnerability in the Wavlink WL-WN592AX6 wireless router (firmware version 250422), affecting the main function of /cgi-bin/upload.cgi. A remote, unauthenticated attacker can trigger the flaw by manipulating the Cookie argument, causing a denial-of-service condition. The vulnerability carries a CVSS 3.1 score of 6.5 (Medium) and a public exploit has been made available; the vendor has been contacted but no patch currently exists.

Technical Analysis

The vulnerability resides in the CGI application /cgi-bin/upload.cgi on the Wavlink WL-WN592AX6 running firmware version 250422. According to the NVD description, the flaw is a null pointer dereference (CWE-404 — Improper Resource Shutdown or Release is the assigned weakness, though the observable symptom is dereferencing a null pointer) triggered in the main function when the Cookie argument is manipulated.

A null pointer dereference in a CGI binary or handler occurs when code receives input that fails validation and subsequently dereferences a pointer that has not been allocated. In this case, the Cookie HTTP header parameter is the malformed input vector. When a crafted or absent Cookie value is supplied, the code path exercised by main in upload.cgi attempts to access memory through a null pointer, resulting in a process crash.

Key characteristics derived strictly from the provided data:

• Attack surface: The /cgi-bin/upload.cgi endpoint is reachable via the router's HTTP management interface. As a CGI handler, it processes HTTP requests and is exposed to network clients (LAN and potentially WAN depending on deployment and management-interface exposure).
• Trigger: Manipulation of the Cookie argument (HTTP Cookie header). The exact payload structure is not specified in the description; no further code-level detail (variable names, offsets, or allocation logic) is available.
• Authentication requirement: The CVSS vector specifies PR:N (No Privileges Required) and UI:N (No User Interaction), meaning the attack can be carried out remotely without credentials.
• Impact class: Availability and low integrity impact (I:L/A:L), consistent with a process crash/DoS rather than code execution.

No public PoC details, memory addresses, or exploitation code are available in the provided intelligence. The description does not confirm RCE or memory corruption beyond the dereference.

Exploitation Scenarios

Note: No public PoC detail is provided beyond the NVD statement that an exploit is available. The following chain is inferred strictly at the vulnerability-class level.

1. Reconnaissance / Target Identification: An attacker scans for Wavlink WL-WN592AX6 devices exposed on a network, identifying the router by its HTTP management interface and the presence of the /cgi-bin/upload.cgi endpoint. Attackers may use Shodan or mass internet scanning to locate reachable management interfaces.

2. Triggering the Flaw: The attacker sends an HTTP request to /cgi-bin/upload.cgi containing a crafted Cookie header value. The specific manipulation (e.g., an empty, malformed, or missing Cookie field that bypasses the expected parsing) drives execution into a code path where a pointer is dereferenced without a null check.

3. Payload / Execution Method: No shellcode or post-exploitation payload is indicated. At the vulnerability-class level, the crafted request causes a null pointer dereference, which typically results in the CGI process terminating abnormally (segmentation fault or equivalent). No authentication is required (PR:N).

4. Post-Exploitation Impact: The primary observable effect is a denial-of-service condition affecting the upload.cgi service and potentially the router's web management interface if the process crash destabilizes the daemon. The low integrity impact (I:L) suggests possible alteration of behavioral state but does not imply code execution or persistent compromise. Repeated requests could sustain a DoS condition.

Impact Assessment

• CVSS 3.1 Base Score: 6.5 (Medium) — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
• Confidentiality: None (C:N) — no direct data exposure indicated.
• Integrity: Low (I:L) — limited impact, not full system compromise.
• Availability: Low (A:L) — service/process crash consistent with DoS.
• Scope: Unchanged (S:U) — impact confined to the vulnerable component.
• Blast Radius: Wavlink WL-WN592AX6 routers running firmware 250422. Devices with the management interface exposed to untrusted networks (WAN or shared LAN) are at greater risk. A public exploit lowers the barrier to exploitation, enabling scripted or botnet-driven DoS.
• Business Impact: Interruption of network connectivity and management access for affected deployments; repeated exploitation could degrade availability of the router and downstream users.

Detection Guidance

Sigma Rule

title: Wavlink WL-WN592AX6 upload.cgi Null Pointer Dereference Attempt
id: 3f8a1c2e-9b4d-4e7a-a1f2-2026109107aa
status: experimental
description: Detects HTTP requests to /cgi-bin/upload.cgi on Wavlink WL-WN592AX6 with anomalous Cookie headers indicating CVE-2026-109107 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109107
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains: '/cgi-bin/upload.cgi'
  selection_method:
    cs-method|in:
      - GET
      - POST
  selection_cookie:
    cs(Cookie)|contains: '='
  anomaly_condition:
    cs(Cookie)|re: '^[\s=;]*$'
  condition: selection_uri and selection_method and (anomaly_condition or selection_cookie)
fields:
  - c-ip
  - cs-uri-stem
  - cs(Cookie)
  - sc-status
falsepositives:
  - Legitimate management traffic with malformed cookies (rare)
level: medium
tags:
  - attack.t1190
  - cve.2026.109107

YARA Rule

rule CVE_2026_109107_Wavlink_UploadCGI_NPD
{
    meta:
        description = "Detects HTTP requests targeting /cgi-bin/upload.cgi on Wavlink WL-WN592AX6 with manipulated Cookie headers"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109107"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $uri = "/cgi-bin/upload.cgi" ascii nocase
        $cookie = "Cookie:" ascii nocase
        $host_wavlink = "Wavlink" ascii nocase
        $http = "HTTP/1." ascii

    condition:
        $uri and $http and $cookie and #cookie >= 1
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109107 Wavlink WL-WN592AX6 upload.cgi Null Pointer Dereference Attempt"; flow:established,to_server; http.uri; content:"/cgi-bin/upload.cgi"; http.header; content:"Cookie:"; nocase; sid:2026109107; rev:1; reference:cve,2026-109107; metadata:affected_product Wavlink_WL-WN592AX6, attack_target IoT, deployment Perimeter, signature_severity Minor, created_at 2026_01_01; classtype:attempted-dos;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method in ("GET", "POST") and
      url.path == "/cgi-bin/upload.cgi" and
      http.request.headers contains "Cookie" ]
  [ network where http.response.status_code >= 500 and
      url.path == "/cgi-bin/upload.cgi" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=stream:http
| search uri_path="/cgi-bin/upload.cgi"
| eval cookie_val=coalesce(cookie, http_cookie)
| where isnotnull(cookie_val) OR isnotnull(cs_Cookie)
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as http_status by src_ip, uri_path, cookie_val
| where count > 3
| eval severity="medium", cve="CVE-2026-109107"
| table first_seen last_seen src_ip uri_path cookie_val http_status count severity cve

Wazuh OSSEC Rule

<group name="wavlink_cve_2026_109107,web,">
  <rule id="202610107" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>/cgi-bin/upload.cgi</match>
    <regex>CVE-2026-109107|upload\.cgi.*Cookie</regex>
    <description>CVE-2026-109107: Wavlink WL-WN592AX6 upload.cgi manipulation attempt via Cookie header.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_dos,pci_dss_6.5,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor was contacted early regarding the disclosure, but no firmware fix is currently available for WL-WN592AX6 firmware version 250422.

1. Immediate Mitigations

   • Restrict administrative access to the router's web management interface; do not expose /cgi-bin/ to WAN or untrusted networks.
   • Block or filter HTTP requests to /cgi-bin/upload.cgi at the network perimeter using the Suricata/WAF rules above.
   • Place affected routers behind a firewall and disable remote management features where supported.
   • Segment IoT/router management traffic onto isolated VLANs with strict access controls.

2. Patch / Upgrade Steps

   • Monitor Wavlink's official support/download page for a firmware update addressing CVE-2026-109107.
   • Since no patch exists, no upgrade path can be validated at this time. Do not apply unverified firmware from third parties.
   • If the device is internet-exposed and mission-critical, evaluate replacement with an actively maintained router.

3. Long-Term Hardening

   • Implement strict null-pointer and input validation checks in firmware (vendor-side).
   • Adopt a firmware update cadence and subscribe to vendor security advisories.
   • Deploy network monitoring (Sigma/Suricata/Wazuh rules above) to detect exploitation attempts and process crashes on management interfaces.
   • Maintain an accurate inventory of IoT/router firmware versions to enable rapid response when a patch lands.

References

1. NVD — CVE-2026-109107: https://nvd.nist.gov/vuln/detail/CVE-2026-109107
2. MITRE CWE-404 — Improper Resource Shutdown or Release: https://cwe.mitre.org/data/definitions/404.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Wavlink official product/support site (firmware advisory to be monitored): https://www.wavlink.com/
5. CISA Known Exploited Vulnerabilities Catalog (verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Public exploit availability is confirmed via the NVD description; no specific threat-actor campaign attribution or in-the-wild exploitation telemetry is provided in the supplied data.