CVE-2026-109107
Received Received - Intake

Null Pointer Dereference in Wavlink WL-WN592AX6 via upload.cgi

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109107
EUVD
EUVD-2026-98338

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wavlink WL-WN592AX6 250422

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a null pointer dereference issue in the Wavlink WL-WN592AX6 router, specifically in the /cgi-bin/upload.cgi file. It occurs when the Cookie argument is manipulated, leading to a crash or potential remote code execution. The exploit is publicly available and can be used remotely.

Detection Guidance

This vulnerability involves a null pointer dereference in Wavlink WL-WN592AX6 via the Cookie argument in /cgi-bin/upload.cgi. To detect it, monitor network traffic for unusual requests to this endpoint with malformed or excessive Cookie headers. Check system logs for crashes or errors related to the web server handling this CGI script.

Impact Analysis

This vulnerability could allow attackers to crash the device, disrupt network services, or potentially execute arbitrary code. Since it is remotely exploitable, an attacker does not need physical access to the device to exploit it.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive data through a null pointer dereference in the Wavlink WL-WN592AX6 device. Remote attackers could exploit this to cause denial of service or unauthorized access, which may violate data protection requirements under these regulations.

Mitigation Strategies

Immediately update the Wavlink WL-WN592AX6 firmware to the latest version to address the null pointer dereference issue in the upload.cgi file. If an update is not available, consider disabling remote access to the /cgi-bin/upload.cgi endpoint or blocking external access to the device until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109107. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart