Vulnerability details
CVE-2026-89009
WAVLINK Technology WN535M1WAVLINK Technology WN535M3
WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server
CVSS 4.0
8.8High
Official description
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header without path canonicalization, allowing attackers to supply an absolute path and write arbitrary content to overwrite startup scripts or credential stores to achieve persistent system compromise.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.8High | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.1Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| WAVLINK Technology | WN535M1 | M35M1_V210223 | CVEProject cvelistV5 (CNA) |
| WAVLINK Technology | WN535M3 | M35M1_V210223 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://docs.wavlink.xyz/Security_Advisory/WAVLINK-SA-2026-091301/ patchvendor-advisory
- https://www.vulncheck.com/advisories/wavlink-wn535m1-wn535m3-unauthenticated-arbitrary-file-write-via-sync-server third-party-advisory
- https://github.com/camdsmith/wavlink-sync_server-rce/blob/main/README.md technical-descriptionexploit
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-11
- Last updated
- 2026-10-29
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
1.01%
Probability of exploitation in 30 days
63.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-36Absolute Path Traversal