CVE-2026-89009 in WN535M1
Summary
by MITRE • 09/11/2026
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header without path canonicalization, allowing attackers to supply an absolute path and write arbitrary content to overwrite startup scripts or credential stores to achieve persistent system compromise.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in WAVLINK WN535M1 and WN535M3 routers running firmware prior to version M35M1_V250922 represents a critical security flaw rooted in improper input validation within the sync_server daemon. This service, which listens on TCP port 13136, operates with root privileges but lacks any form of authentication mechanism for incoming connections. The core technical deficiency lies in the handling of filename fields provided by clients during protocol interactions. Specifically, the daemon accepts a one-hundred-byte filename field from its protocol header without performing path canonicalization or sanitization checks. This architectural oversight allows remote attackers to supply absolute file paths rather than relative ones, effectively bypassing any intended directory restrictions and enabling direct writes to arbitrary locations on the device's filesystem.
From an operational perspective, this unauthenticated arbitrary file write vulnerability poses a severe risk to system integrity and availability. Because the daemon runs as root, any files written by an attacker inherit these elevated privileges. Malicious actors can exploit this capability to overwrite critical startup scripts such as rc.local or init.d entries, thereby ensuring that malicious code executes automatically upon every device reboot. Alternatively, attackers may target credential stores or configuration files containing sensitive authentication tokens and passwords. By modifying these files, the adversary gains persistent access to the network infrastructure, potentially using the compromised router as a pivot point for further lateral movement within the local network or as part of a larger botnet assembly.
This vulnerability aligns with CWE-434, which describes the unrestricted upload of file with dangerous type, and more specifically CWE-22, the improper limitation of a pathname to a restricted directory, due to the lack of canonicalization that permits traversal outside intended boundaries. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, as it facilitates the execution of arbitrary commands through script modification. It also relates to T1486, Data Encrypted for Impact, if used in conjunction with ransomware deployment, or more commonly T1037, Boot or Logon Initialization Scripts, when utilized for persistence. The absence of authentication combined with root-level file system access creates a high-severity attack vector that requires immediate remediation to prevent unauthorized control over the network gateway device.
Mitigation strategies must prioritize updating the router firmware to version M35M1_V250922 or later, where these input validation flaws have been addressed by implementing strict path canonicalization and restricting write permissions for the sync_server daemon. In environments where immediate patching is not feasible, network segmentation should be employed to restrict access to TCP port 13136 from untrusted networks. Additionally, disabling unused services like sync_server if they are not required for normal operation can significantly reduce the attack surface. Security monitoring tools should also be configured to detect anomalous outbound connections or unusual file system modifications that may indicate exploitation of this vulnerability in real-time.