Executive brief
WAVLINK WN535M1 and WN535M3 mesh routers contain a critical flaw in their mesh synchronization daemon that allows unauthenticated remote attackers to overwrite any file on the device. By sending a crafted message over the network to the unprotected daemon, an attacker can replace system files—such as startup scripts or credential stores—to gain permanent control of the router. This affects models in active use, and most devices in the field cannot be easily patched due to a high-risk firmware update procedure.
Technical details
The sync_server daemon running as root on TCP port 13136 accepts file-transfer messages with no authentication and processes the filename field without path canonicalization. An attacker can supply an absolute path in the 100-byte filename field to write arbitrary content to any location on the filesystem. The vulnerability is a combination of missing authentication (CWE-306) and improper path handling (CWE-36), exploitable over the network from any host with reachability to TCP 13136. Proof-of-concept code demonstrates arbitrary file write and command injection primitives against affected hardware. The vendor has confirmed and independently reproduced the issue; a fix exists in firmware M35M1_V250922, but affected models are discontinued and most devices remain vulnerable in the field.
Affected products
- WAVLINK WN535M1 prior to M35M1_V250922
- WAVLINK WN535M3 prior to M35M1_V250922
Timeline
- 2026-08-03: disclosed: Vulnerability reported to vendor with PoC
- 2026-09-11: advisory: CVE-2026-89009 published; advisory and PoC released
- 2025-09-22: patched: Fixed in firmware M35M1_V250922