| Titolo | Wavlink WN535M1 M35M1_V210223 OS Command Injection |
|---|
| Descrizione | The mesh-sync daemon (usr/bin/sync_server) on Wavlink WN535M1 (HALO Base Pro, AC1200 Dual-band Whole Home Mesh WiFi System), firmware M35M1_V210223, listens unauthenticated on TCP port 13136 whenever the daemon is running. A supervisor script (monitor_process.sh) starts sync_server automatically when MeshMode == "1", which is the out-of-box default configuration on this device. The daemon itself performs no MeshMode check.
The daemon implements a custom binary file-transfer protocol: a 128-byte header (message type at offset 0, 4-byte little-endian file size at offset 1, 6-byte MAC placeholder at offset 5, 17 bytes padding at offset 11, 100-byte null-padded filename at offset 28) followed by the raw file content.
Vulnerability 1: The filename field is used directly in an open()/write() call with no path validation, allowing arbitrary file write to any absolute path whose parent directory already exists.
Vulnerability 2: If the filename contains the substring "/tmp/sync_system/ap_report/", the full filename is passed unsanitized into a shell command built with sprintf(cmd, "apply_sync_data.sh server %s&", filename) and executed via system(). Because the filename is attacker-controlled, embedded shell metacharacters are interpreted by the shell, yielding arbitrary OS command execution as root. Confirmed by decompilation (function at offset 0x404734): open(param_3,0x302) is called on the raw attacker-controlled filename with zero validation, and sprintf(acStack_428,"apply_sync_data.sh server %s&",param_3) followed by system(acStack_428) executes it.
Reachability: confirmed via decompilation that the vulnerable listener (function at offset 0x402fd8, binds x.x.x.x:13136) has no interface restriction in the binary itself. Confirmed via direct read of /etc/config/firewall that the device's wan zone default-REJECTs inbound traffic and does not open port 13136, while the lan zone default-ACCEPTs. In the factory-default configuration this is exploitable from the LAN/mesh-adjacent network segment, not from the WAN/public internet, absent manual port-forwarding by the device owner.
An attacker on the local/adjacent network can therefore achieve full remote code execution as root with Wavlink a single crafted message, no credentials, and no user interaction. Confirmed by the researcher against physical WN535M1 hardware, resulting in a root shell.
CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 8.8 (High)
The same sync_server binary/codebase was also found in firmware for the Wavlink WL-NU516U1, though the vulnerable port was not listening by default on that device.
Coordinated disclosure: vendor was contacted privately via email ([email protected]) on 2026-08-03, given a 90 day coordinated disclosure timeline. This is the ideal private-channel disclosure path per VulDB's own submission policy; a public advisory/PoC link is intentionally not included while the embargo with the vendor is active. Please reserve a CVE for this vulnerability. |
|---|
| Utente | camdsmith (UID 100319) |
|---|
| Sottomissione | 03/08/2026 14:47 (3 mesi fa) |
|---|
| Moderazione | 12/10/2026 10:33 (2 months later) |
|---|
| Stato | Duplicato |
|---|
| Voce VulDB | 914024 |
|---|
| Punti | 0 |
|---|