Remote Command Injection in Wavlink WL-WN592AX6

A critical security flaw has been identified in the Wavlink WL-WN592AX6 router, specifically within the wmapd daemon component of firmware version 250422. This vulnerability allows an unauthenticated, remote attacker to trigger OS command injection via the system function. Because the device is an edge networking product, successful exploitation provides an attacker with complete control over the network traffic passing through the router, enabling man-in-the-middle attacks, credential harvesting, and pivoting into the internal network. Proof-of-concept exploit code for this vulnerability is publicly available, significantly increasing the likelihood of opportunistic exploitation by threat actors. Defenders should prioritize isolating affected hardware from the internet or restricting management interface access.

Impact

Successful exploitation results in full remote compromise of the affected Wavlink WL-WN592AX6 router. Attackers can gain root-level access to the underlying operating system, potentially leading to persistent backdoors, data exfiltration from network traffic, and unauthorized access to local area network resources. This represents a critical risk to small office and home office (SOHO) environments utilizing this specific hardware and firmware version.

Recommendation

• Restrict management interface access to the Wavlink WL-WN592AX6 to trusted internal management subnets only.
• Implement outbound traffic filtering on the router's host to detect and block suspicious call-home beacons.
• Monitor for unauthorized configuration changes or unexpected process execution within the router's environment if logging is available.
• Check for and apply firmware updates from Wavlink to remediate the vulnerable wmapd daemon.