WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command

Published September 11, 2026 CVE-2026-89010

Two older Wavlink home mesh routers let anyone on the network take them over completely, no password needed. An attacker just sends a specially crafted message to a background service and gets full root control of the device.

Severity
CriticalCVSS 3.1 · 9.8 · vulncheck.com
Fix
Not confirmedLast checked today
Affected versions
M35M1_V210223; M35M1_V210223
Weakness
CWE-78OS Command Injection
Affects
WN535M1+1 more
Exploited
Not confirmedPublic proof of concept, per CISA SSVC
CISA SSVC
Proof of concept publicAutomatable: yes · Technical impact: total
EU ID
EUVD-2026-76130ENISA vulnerability database

How it works

  • The WN535M1 and WN535M3 run a background program called sync_server that listens on network port 13136 whenever mesh mode is enabled, which is the default setting on the WN535M1 out of the box.
  • This program accepts file-transfer messages from anyone on the network without checking who sent them.
  • One of the fields in that message, the filename, gets inserted directly into a command the device runs on itself.
  • Because the program does not strip out special characters first, an attacker can hide extra commands inside the filename.
  • The device then runs those commands with full root privileges, the highest level of access on the machine.

What to do

Check whether your router is a WAVLINK WN535M1 or WN535M3 and note its firmware version from the device's admin page. If it shows firmware M35M1_V210223 or anything earlier than M35M1_V250922, treat it as affected. The researcher notes the exact status of firmware versions between those two dates has not been confirmed. Check whether mesh mode is turned on in the router's settings, since that is what makes the device listen on the exposed network port.

Turn off mesh mode in the router's settings if you don't need it, since this stops the vulnerable service from listening on the network at all, though you lose mesh functionality. Block inbound connections to TCP port 13136 at your network's edge if you keep mesh mode. Update to firmware M35M1_V250922 if you want the underlying fix, but note WAVLINK says this requires a two-step recovery procedure with a real risk of bricking the device, so read the vendor's own instructions before attempting it. Be aware WAVLINK has confirmed these models are discontinued and no longer actively supported, so a straightforward automatic update is not available.

Technical details

Affected software: WN535M1by WAVLINK Technology, WN535M3by WAVLINK Technology

CVE-2026-89010 is an unauthenticated OS command injection (CWE-78) in the sync_server mesh-sync daemon on WAVLINK WN535M1 and WN535M3 routers, reachable over TCP port 13136 whenever mesh mode is enabled. Attacker-controlled filename data from unauthenticated file-transfer messages is inserted into a shell command via sprintf and passed to system without sanitization, giving remote root code execution. CVSS 3.1 base score 9.8 (critical). The vendor confirmed and independently reproduced the issue on its own hardware but has not shipped a straightforward patch path since these models are discontinued; the fixed firmware M35M1_V250922 requires a recovery procedure rather than a normal update.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source