Remote Code Execution Vulnerability in Wavlink WL-WN592AX6 Router

CVE-2026-109107

What is CVE-2026-109107?

A vulnerability has been discovered in the Wavlink WL-WN592AX6 router, specifically affecting the upload.cgi script's main function. This issue arises from improper handling of the Cookie argument, leading to a null pointer dereference. The vulnerability allows attackers to exploit the router remotely, potentially resulting in denial-of-service conditions. Publicly available exploit techniques may facilitate unauthorized access, highlighting the necessity for immediate remediation. The vendor has been informed about this issue and further action is advised to protect network integrity.

References