Overview
A critical arbitrary file write vulnerability has been disclosed in WAVLINK WN535M1 and WN535M3 consumer routers. Tracked as CVE-2026-89009, the flaw lets an unauthenticated remote attacker overwrite any file on the device by sending a specially crafted payload to the sync_server daemon, which listens on TCP port 13136 and runs as root.
Because the daemon requires no authentication and accepts an attacker-controlled filename field without path canonicalization, an attacker on the same network — or reachable over the internet if the management interface is exposed — can supply an absolute path such as a startup script or credential store and overwrite its contents to gain persistent control of the device.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-89009 |
| Severity | Critical |
| CVSS Score | 9.1 |
| Attack Vector | Network (TCP/13136) |
| Authentication | None Required |
| Privileges Required | None |
| Affected Daemon | sync_server (runs as root) |
The sync_server protocol header includes a 100-byte filename field that is never checked for directory traversal or restricted to a safe base directory. An attacker can supply an absolute path — for example targeting /etc/passwd or a boot-time init script — and have the daemon write arbitrary attacker-supplied content directly to that location.
Why This Matters
Root-level, unauthenticated file overwrite on a network device is effectively full device takeover:
- Overwriting startup scripts grants persistent code execution across reboots
- Overwriting credential files can weaken or disable local authentication
- Combined with the companion command-injection flaw in the same daemon (see below), an attacker can chain file write with direct command execution for a faster, more reliable compromise
Companion Vulnerability
The same sync_server daemon is also affected by CVE-2026-89010, an unauthenticated OS command injection flaw (CVSS 9.8) that allows direct root command execution. Devices exposed to CVE-2026-89009 should be assumed vulnerable to both.
Remediation
- Update firmware immediately to
M35M1_V250922or later - Do not expose router management or sync services (TCP 13136) to the public internet
- Place affected devices behind a firewall or segment them from untrusted networks until patched
- Audit devices for unexpected changes to startup scripts or configuration files if exposure is suspected
Organizations and home users running WAVLINK WN535M1/WN535M3 hardware should treat this as an urgent patch priority given the lack of any authentication requirement.