CVE-2026-109110

Executive Summary

CVE-2026-109110 is an OS command injection vulnerability (CWE-77) in the Wavlink WL-WN592AX6 wireless router, firmware build 250422, affecting a function within the wmapd daemon component. The flaw is remotely reachable with no authentication, no user interaction, and low attack complexity, yielding a CVSS 3.1 base score of 10.0 with scope change (S:C) and full confidentiality, integrity, and availability impact. Because the exploit has been publicly disclosed and the device is unpatched, any internet-exposed WL-WN592AX6 running the affected build should be considered fully compromised-capable and must be isolated or replaced.

Technical Analysis

The vulnerability resides in the wmapd daemon of the Wavlink WL-WN592AX6 at firmware build 250422. Per the NVD description, the issue affects "the function system" of that component and is triggered by "a manipulation" — that is, crafted input passed to a component-side function — which results in OS command injection. CWE-77 (Improper Neutralization of Special Elements used in a Command) confirms the root-cause class: untrusted input reaches a command execution sink without adequate neutralization, allowing the attacker to append or inject shell metacharacters that the underlying OS interprets as additional commands.

The attack surface is the wmapd daemon's externally reachable interface. The CVSS vector AV:N/PR:N/UI:N establishes that no credentials or user action are required, and S:C indicates the exploitation escapes the vulnerable component's security scope — impact is scored against the host OS and adjacent resources rather than the daemon alone. In embedded router firmware, daemons of this type typically run with elevated (often root) privileges, which is consistent with the C:H/I:H/A:H subscores: successful injection yields arbitrary command execution as the daemon's user, enabling full device takeover.

Because the public description does not disclose the specific parameter name, request path, HTTP method, or the exact system() call site, no further code-level detail can be asserted. The class-level mechanism is definitive: an unauthenticated, remotely supplied input is interpolated into a shell command executed by wmapd, and metacharacter injection breaks out of the intended command context. No patch diff, vendor advisory, or fixed firmware version is available for differential analysis, so the precise parsing/validation gap cannot be confirmed from public data. No CVE-level EPSS score has been published by FIRST.org at the time of writing, and the CVE is not listed in CISA KEV.

Exploitation Scenarios

1. Reconnaissance / target identification: An attacker scans for internet-exposed Wavlink WL-WN592AX6 devices. Shodan-style fingerprinting on the device model, the Wavlink management interface, or the wmapd service banner identifies candidate hosts running build 250422. Because the flaw is network-reachable (AV:N) with no authentication (PR:N), no credential-gathering phase is required.

2. Triggering the flaw class: The attacker sends a crafted request to the wmapd daemon's network-exposed interface. The request manipulates an input value that the daemon passes into an OS command execution call. Per CWE-77, the injected value contains shell metacharacters or command separators that are not neutralized, causing the daemon to execute attacker-controlled commands in addition to (or instead of) the intended command.

3. Payload / execution method: At the vulnerability-class level, exploitation is standard OS command injection — the attacker-supplied string is interpreted by the shell, allowing arbitrary commands to run in the security context of wmapd. The published description confirms an exploit "has been published and may be used," but no PoC code, request body, or endpoint is provided in the supplied data. No public exploitation tooling (Nuclei template or reference exploit code) is tracked in the provided dataset; the exact payload shape is therefore not reproducible from this report alone.

4. Post-exploitation impact: With command execution as the daemon's user (typically privileged on embedded firmware), the attacker can achieve full device compromise — reading device configuration, extracting credentials, altering routing/DNS behavior, persisting via firmware or startup hooks, and using the device as a pivot or botnet node. The CVSS scope-change score reflects that impact extends beyond wmapd to the host OS and attached network.

Impact Assessment

Business impact is severe. A CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is the maximum possible; every metric is at its worst-case value. Remotely and unauthenticated, an attacker gains arbitrary command execution on the device with high confidentiality, integrity, and availability loss, and the scope change (S:C) means collateral impact on resources beyond the vulnerable daemon.

Affected systems: Wavlink WL-WN592AX6 running firmware build 250422. Because no version range is published, operators must inventory by exact build string rather than by a semantic range; any device matching the identified build should be treated as vulnerable. Blast radius includes every network segment the router serves — in SMB, branch, or home-office deployments this can mean full visibility into and control over downstream traffic, DNS resolution, and firewall policy. Compromised units can be recruited into DDoS botnets, used for traffic interception or credential harvesting via DNS/routing manipulation, or held as persistent footholds for lateral movement into the protected network. The absence of CISA KEV listing and an EPSS score should not be read as low risk — they reflect scoring/tracking lag, not exploitation likelihood, which the "exploit has been published" statement directly contradicts.

Detection Guidance

Sigma Rule

title: Potential OS Command Injection Against Wavlink WL-WN592AX6 wmapd Daemon
id: 8f3c1a2e-5d47-4b9a-9c1e-2b7f6d0a4e11
status: experimental
description: Detects shell metacharacter patterns in HTTP requests targeting the Wavlink WL-WN592AX6 wmapd daemon interface (CVE-2026-109110).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109110
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_target:
    cs-uri-query|contains:
      - 'wmapd'
  selection_metachars:
    cs-uri-query|contains:
      - ';'
      - '|'
      - '`'
      - '$('
      - '&&'
      - '>/'
      - 'wget '
      - 'curl '
      - '/bin/sh'
      - '/etc/passwd'
  condition: selection_metachars
falsepositives:
  - Legitimate administrative tooling that passes shell-like characters
level: high
tags:
  - attack.t1190
  - cve.2026.109110

YARA Rule

rule CVE_2026_109110_Wavlink_wmapd_CmdInjection
{
    meta:
        description = "Detects shell metacharacter injection patterns associated with CVE-2026-109110 in Wavlink WL-WN592AX6 wmapd request captures"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109110"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $d1 = "wmapd" ascii nocase
        $m1 = ";" ascii
        $m2 = "|" ascii
        $m3 = "$(" ascii
        $m4 = "`" ascii
        $m5 = "&&" ascii
        $cmd1 = "/bin/sh" ascii nocase
        $cmd2 = "wget " ascii nocase
        $cmd3 = "curl " ascii nocase
        $cmd4 = "/etc/passwd" ascii nocase

    condition:
        $d1 and 1 of ($m*) and 1 of ($cmd*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109110 Wavlink WL-WN592AX6 wmapd OS Command Injection Attempt"; flow:established,to_server; http.uri; content:"wmapd"; nocase; http.uri; content:";"; http.uri; content:"|2F|bin|2F|sh"; nocase; reference:cve,2026-109110; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109110; classtype:web-application-attack; sid:2026109110; rev:1;)

Elastic Detection

sequence by host.name, source.ip with maxspan=5s
  [network where network.protocol == "http" and url.query : "*wmapd*"]
  [network where network.protocol == "http" and url.query regex ".*(;|\\||\\$\\()(wget|curl|/bin/sh|cat ).*"]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=suricata
| eval uri_q = coalesce(uri_query, url, cs_uri_query, "")
| where match(uri_q, "(?i)wmapd") AND match(uri_q, "(;|\||\$\(|`).*(wget|curl|/bin/sh|/etc/passwd)")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources values(uri_q) as sample_queries by dest_host
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="wavlink,web,cve-2026-109110,">
  <rule id="2026109" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>wmapd</url>
    <regex type="pcre2">(;|\||\$\(|`)(wget|curl|/bin/sh|/etc/passwd)</regex>
    <description>CVE-2026-109110: Possible OS command injection against Wavlink WL-WN592AX6 wmapd daemon</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Remove or block all internet exposure of the WL-WN592AX6 management/wmapd-facing interface; do not rely on WAN-side ACLs alone if the daemon is reachable from LAN or guest/VLAN segments.
• Segment IoT and consumer-grade routers onto isolated VLANs with deny-by-default rules to any trusted network, limiting scope change (S:C) fallout.
• If the device must remain in service, place it behind a reverse proxy or WAF with strict input validation and metacharacter blocking, and enable logging of all requests to the wmapd interface.
• Monitor for the detection signatures above; treat any hit as a likely compromise and initiate incident response (rotation of all credentials/config secrets transiting the device).

2. Patch/upgrade steps:

• No fixed firmware version has been published. Check the Wavlink support site and the vendor directly for a corrected build for WL-WN592AX6; the vendor was contacted about the disclosure, so a fix may be forthcoming. Until a vendor build is confirmed to remediate CWE-77, upgrading cannot be assumed to resolve the issue — verify with the vendor or via independent testing.
• If no fix is available, replace the affected unit with a supported model or a maintained open-source firmware (where hardware permits) rather than continuing to operate vulnerable firmware.

3. Long-term hardening:

• Enforce a firmware lifecycle policy that prohibits end-of-support networking hardware on any production or perimeter network.
• Restrict router/CPE administrative planes to out-of-band or management-only VLANs.
• Adopt continuous CVE monitoring tied to exact firmware build inventory, since this CVE has no semver range and must be matched by build string.
• Input validation and command-construction review (avoid shell interpolation; use argument-vector APIs) should be a procurement requirement for embedded network gear.

References

• NVD — CVE-2026-109110: https://nvd.nist.gov/vuln/detail/CVE-2026-109110
• CWE-77 — Improper Neutralization of Special Elements used in a Command: https://cwe.mitre.org/data/definitions/77.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Wavlink official support/download portal (vendor advisory pending): https://www.wavlink.com/
• CISA Known Exploited Vulnerabilities Catalog (status check — CVE not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note on exploit-in-the-wild evidence: the NVD description states the exploit "has been published and may be used." No named threat actor campaign, malware family, or CISA KEV entry is associated with CVE-2026-109110 in the supplied intelligence data, and no EPSS score is available from FIRST.org at this time.