CVE-2026-89010

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability (CWE-78, CVSS 4.0: 9.3 critical) in the sync_server daemon, which builds a shell command string from an attacker-supplied filename using sprintf() and passes it to system() without sanitization. A remote attacker with network access to TCP port 13136 can send a crafted filename containing shell metacharacters, which the daemon interpolates directly into the command string. Successful exploitation yields arbitrary command execution as root on the router, giving the attacker full control of the device, including the ability to inspect or redirect traffic and pivot into the local network. Only WN535M1 and WN535M3 devices running affected firmware are vulnerable, with the greatest risk to units whose TCP port 13136 is reachable from the internet. No public proof-of-concept is known and the flaw is not in CISA's KEV, so exploitation has not been confirmed.

What to do: Upgrade affected WN535M1/WN535M3 routers to firmware M35M1_V250922 or later. Until upgrading, ensure TCP port 13136 is not reachable from the WAN via firewall or port-forwarding rules, since remote unauthenticated access to that port is the only requirement for exploitation. Because the flaw grants root-level execution on the router, review devices with internet-exposed port 13136 for signs of compromise and consider a factory reset after updating if exposure is confirmed.