CVE-2026-89009
WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header without path canonicalization, allowing attackers to supply an absolute path and write arbitrary content to overwrite startup scripts or credential stores to achieve persistent system compromise.
| CWE | CWE-36 |
| Vendor | wavlink technology |
| Product | wn535m1 |
| Published | Sep 11, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for wavlink technology wn535m1
Be the first to know when new critical vulnerabilities affecting wavlink technology wn535m1 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Affected Versions
WAVLINK Technology / WN535M1
M35M1_V210223
WAVLINK Technology / WN535M3
M35M1_V210223
References
Credits
Cameron Smith