CVE-2026-89010: WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the syncserver daemon on TCP port 13136. The daemon interpolates attacker-controlled filename input containing shell metacharacters into a shell command string via sprintf() and passes it to system() without sanitization, enabling root-level command execution on the device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WAVLINK WN535M1 and WN535M3 routersto a version that resolves this vulnerability.Fixed in M35M1_V250922
Event History
Frequently Asked Questions
Which devices and firmware are affected?
WAVLINK WN535M1 and WN535M3 routers running firmware earlier than M35M1_V250922 are affected.
Does exploitation require authentication or user interaction?
No. A remote attacker can exploit the issue without authentication or user interaction by sending crafted filename input to sync_server on TCP port 13136.
What level of access can an attacker obtain?
Successful exploitation permits arbitrary OS command execution as root on the affected router.
What should be checked during exposure assessment?
Identify WN535M1 and WN535M3 devices with firmware before M35M1_V250922, and determine whether TCP port 13136 is reachable by untrusted networks. The vulnerable service is the sync_server daemon listening on that port.