WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file

Published September 11, 2026 CVE-2026-89009

WAVLINK's WN535M1 and WN535M3 mesh routers let anyone on the network rewrite files on the device without a password. An attacker can use this to plant startup scripts and take lasting control of the router.

Severity
CriticalCVSS 3.1 · 9.1 · vulncheck.com
Fix
Not confirmedLast checked today
Affected versions
M35M1_V210223; M35M1_V210223
Weakness
CWE-36Absolute Path Traversal
Affects
WN535M1+1 more
Exploited
Not confirmedNo confirmation recorded
EU ID
EUVD-2026-76129ENISA vulnerability database

How it works

  • The routers run a background program called sync_server that keeps mesh routers in sync with each other.
  • It listens on network port 13136 whenever mesh mode is turned, which is the default out-of-box setting on the WN535M1.
  • It accepts messages over the network without checking any password.
  • Each message carries a 100 character field naming a file to write, and the program never checks whether that name points outside its own safe folder.
  • Someone can put in a full file path, such as a system startup file, instead of a normal filename.
  • Because sync_server runs with full root-level power, whatever file it is told to write gets overwritten with attacker-supplied content, including files the router needs to start up or store credentials.

What to do

Check your WAVLINK WN535M1 or WN535M3 router's firmware version in its admin page and compare it against M35M1_V210223, the version WAVLINK confirmed is vulnerable. Check whether mesh mode is turned, since that setting is what makes the sync_server program listen on network port 13136. If mesh mode is on and the firmware predates M35M1_V250922, the router is reachable by anyone on the same network, including devices on a guest Wi-Fi network.

Turn off mesh mode in the router's admin settings if you do not need it, since this stops the vulnerable program from listening on port 13136. Block inbound access to TCP port 13136 at your network boundary if you cannot disable mesh mode. Update to firmware M35M1_V250922 if you are willing to follow WAVLINK's recovery procedure, since the vendor says these older units cannot be upgraded directly and the update needs a separate recovery process that carries a risk of disabling the device. Watch WAVLINK's documentation site for further firmware guidance, since the company has said these models are discontinued.

Technical details

CVE-2026-89009 affects the sync_server mesh-sync daemon on WAVLINK WN535M1 and WN535M3 firmware, which listens unauthenticated on TCP port 13136 whenever mesh mode is enabled. Its protocol accepts a 100-byte filename field with no path canonicalization, so a caller can supply an absolute path and write attacker-controlled content to any file as root, including startup scripts. This is rated 9.1 under CVSS 3.1 and high (8.8) under CVSS 4.0. WAVLINK confirmed and reproduced the issue on firmware M35M1_V210223 and named M35M1_V250922 as the fixed build, though the exact version boundary between them is unresolved and the vendor considers these models discontinued.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Open in FIRST.org calculator

References

View Original Source