| Titel | Wavlink AC1200 Halo Base Pro M35M1_V210223 OS Command Injection |
|---|
| Beschreibung | The mesh-sync daemon (usr/bin/sync_server) on Wavlink WN535M1 (HALO Base Pro, AC1200 Dual-band Whole Home Mesh WiFi System), listens unauthenticated on TCP port 13136 whenever the daemon is running. A supervisor script (monitor_process.sh) starts sync_server automatically when MeshMode == "1", which is the out-of-box default configuration on this device. The daemon itself performs no MeshMode check.
The daemon implements a custom binary file-transfer protocol: a 128-byte header (message type at offset 0, 4-byte little-endian file size at offset 1, 6-byte MAC placeholder at offset 5, 17 bytes padding at offset 11, 100-byte null-padded filename at offset 28) followed by the raw file content.
Vulnerability 1: The filename field is used directly in an open()/write() call with no path validation, allowing arbitrary file write to any absolute path whose parent directory already exists.
Vulnerability 2: If the filename contains the substring "/tmp/sync_system/ap_report/", the full filename is passed unsanitized into a shell command built with sprintf(cmd, "apply_sync_data.sh server %s&", filename) and executed via system(). Because the filename is attacker-controlled, embedded shell metacharacters are interpreted by the shell, yielding arbitrary OS command execution as root.
Reachability: confirmed via decompilation that the vulnerable listener (function at offset 0x402fd8, binds x.x.x.x:13136) has no interface restriction in the binary itself. Confirmed via direct read of /etc/config/firewall that the device's wan zone default-REJECTs inbound traffic and does not open port 13136, while the lan zone default-ACCEPTs. In the factory-default configuration this is exploitable from the LAN/mesh-adjacent network segment, not from the WAN/public internet, absent manual port-forwarding by the device owner.
An attacker on the local/adjacent network can therefore achieve full remote code execution as root with a single crafted message, no credentials, and no user interaction. Confirmed by the researcher against physical WN535M1 hardware, resulting in a root shell.
CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 8.8 (High)
The same sync_server binary/codebase was also found in firmware for the Wavlink WL-NU516U1, though the vulnerable port was not listening by default on that device. Once enabled, the vulnerability could also be exploited.
Vendor contacted 2026-08-03, given a 90 day coordinated disclosure timeline — please reserve a CVE for this vulnerability.
|
|---|
| Benutzer | camdsmith (UID 100319) |
|---|
| Einreichung | 03.08.2026 13:52 (vor 3 Monaten) |
|---|
| Moderieren | 12.10.2026 10:33 (2 months later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 402453 [WAVLINK WN535M1/WN535M3 bis M35M1_V210223 sync_server system filenames erweiterte Rechte] |
|---|
| Punkte | 0 |
|---|