Executive brief
WAVLINK WN535M1 and WN535M3 mesh routers contain a critical flaw in their sync_server component that allows an attacker on the local network to execute arbitrary commands with root privileges without any authentication. When mesh mode is enabled (the factory default), the vulnerable service listens on TCP port 13136 and processes attacker-controlled filename data without proper validation, enabling immediate takeover of the device and full access to network traffic and connected systems.
Technical details
The vulnerability is an OS command injection (CWE-78, CWE-306) in the sync_server mesh-sync daemon running on TCP port 13136. The daemon accepts file-transfer messages with no authentication and unsafely interpolates the filename parameter into a shell command via sprintf() and system() without sanitization, allowing shell metacharacters to be interpreted as commands. The attack requires only network reachability to the vulnerable port; no credentials, device pairing, or user interaction are necessary. An unauthenticated remote attacker can spawn a root shell, execute arbitrary commands as root, or write arbitrary files to the filesystem. Affected firmware versions prior to M35M1_V250922 are vulnerable; the vendor has patched the issue but states these models are discontinued and most devices in the field will never receive the update.
Affected products
- WAVLINK WN535M1 prior to M35M1_V250922
- WAVLINK WN535M3 prior to M35M1_V250922
Timeline
- 2026-08-11: disclosed: Advisory and PoC published
- 2026-09-25: patched: Fixed firmware M35M1_V250922 released
- 2026-09-11: advisory: CVE-2026-89010 published