Overview
WAVLINK WN535M1 and WN535M3 routers are affected by a critical, unauthenticated OS command injection vulnerability tracked as CVE-2026-89010. The flaw lives in the same sync_server daemon (TCP port 13136) covered by the companion advisory CVE-2026-89009, but is significantly more severe: it grants an attacker direct, root-level remote code execution rather than just a file overwrite.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-89010 |
| Severity | Critical |
| CVSS 3.1 Score | 9.8 |
| Attack Vector | Network (TCP/13136) |
| Authentication | None Required |
| Privileges Required | None |
| CWE | CWE-78 (OS Command Injection) |
| Assigner | VulnCheck |
The sync_server daemon interpolates an attacker-controlled filename field directly into a shell command string using sprintf(), then passes the result to system() without sanitizing shell metacharacters. By embedding characters like ;, `, or | in the filename field, a remote attacker can inject arbitrary commands that execute as root — with no authentication and no user interaction.
Why This Matters
This is about as severe as router vulnerabilities get:
- No authentication is required to reach the vulnerable service
- No user interaction is needed — a single crafted network packet triggers execution
- Commands run as root, giving full control of the device, including firmware modification, traffic interception, and use as a pivot point into the local network or a botnet node
- The flaw is trivially scriptable, making mass exploitation of internet-exposed devices likely once proof-of-concept code circulates
Remediation
- Update firmware immediately to
M35M1_V250922or later — this is the only complete fix - Block or firewall TCP port 13136 at the network edge if immediate patching isn't possible
- Never expose router administrative or sync services directly to the internet
- Treat any device that was reachable on port 13136 prior to patching as potentially compromised and consider a factory reset plus firmware reflash
Given the CVSS 9.8 score and zero authentication barrier, this vulnerability should be treated as an active exploitation risk even before public proof-of-concept code appears.