WAVLINK-SA-2026-091302: Command Injection in WN535M1
Abstract
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync_server daemon on TCP port 13136. The daemon interpolates attacker-controlled filename input containing shell metacharacters into a shell command string via sprintf() and passes it to system() without sanitization, enabling root-level command execution on the device. This vulnerability was reported together with CVE-2026-89009 (unauthenticated arbitrary file write in the same sync_server daemon on TCP port 13136); both issues affect the same models and are addressed by the same firmware release.
Affected Products
| Product | Affected Firmware | Fixed Firmware | Availability |
|---|---|---|---|
| WN535M1 Wi-Fi Router | Prior to M35M1_V250922 and earlier |
M35M1_V250922 or later |
Available now · Download |
Detail
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync_server daemon on TCP port 13136. The daemon interpolates attacker-controlled filename input containing shell metacharacters into a shell command string via sprintf() and passes it to system() without sanitization, enabling root-level command execution on the device. This vulnerability was reported together with CVE-2026-89009 (unauthenticated arbitrary file write in the same sync_server daemon on TCP port 13136); both issues affect the same models and are addressed by the same firmware release. Tracked as CVE-2026-89010 · CVSS v3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Solution
Update the firmware to version M35M1_V250922 or later or later.
Acknowledgement
Thanks to Cam Smith for reporting this vulnerability.
Reference
CVE-2026-89010 · NVD entry