{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3owavlinkwl-wn592ax6_firmware250422/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:wavlink:wl-wn592ax6_firmware:250422:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-109110"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WL-WN592AX6 (250422)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","command-injection","iot","router","network-infrastructure"],"_cs_type":"advisory","_cs_vendors":["Wavlink"],"content_html":"\u003cp\u003eA critical security flaw has been identified in the Wavlink WL-WN592AX6 router, specifically within the wmapd daemon component of firmware version 250422. This vulnerability allows an unauthenticated, remote attacker to trigger OS command injection via the system function. Because the device is an edge networking product, successful exploitation provides an attacker with complete control over the network traffic passing through the router, enabling man-in-the-middle attacks, credential harvesting, and pivoting into the internal network. Proof-of-concept exploit code for this vulnerability is publicly available, significantly increasing the likelihood of opportunistic exploitation by threat actors. Defenders should prioritize isolating affected hardware from the internet or restricting management interface access.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote compromise of the affected Wavlink WL-WN592AX6 router. Attackers can gain root-level access to the underlying operating system, potentially leading to persistent backdoors, data exfiltration from network traffic, and unauthorized access to local area network resources. This represents a critical risk to small office and home office (SOHO) environments utilizing this specific hardware and firmware version.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict management interface access to the Wavlink WL-WN592AX6 to trusted internal management subnets only.\u003c/li\u003e\n\u003cli\u003eImplement outbound traffic filtering on the router's host to detect and block suspicious call-home beacons.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized configuration changes or unexpected process execution within the router's environment if logging is available.\u003c/li\u003e\n\u003cli\u003eCheck for and apply firmware updates from Wavlink to remediate the vulnerable wmapd daemon.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T10:34:21Z","date_published":"2026-10-13T10:34:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wavlink-rce/","summary":"The wmapd daemon in Wavlink WL-WN592AX6 firmware version 250422 is vulnerable to remote, unauthenticated OS command injection, allowing full device takeover.","title":"Remote Command Injection in Wavlink WL-WN592AX6","url":"https://feed.craftedsignal.io/briefs/2026-10-wavlink-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:o:wavlink:wl-Wn592ax6_firmware:250422:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}