CVE-2026-89010
WAVLINK WN535M1 and WN535M3 routers with firmware before M35M1_V250922 are vulnerable to an unauthenticated OS command injection. By sending specially crafted filenames to the sync_server daemon on TCP port 13136, an attacker can run arbitrary commands as root. The flaw stems from unsanitized input being passed to a shell via system().
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WAVLINK WN535M1 and WN535M3 routers running firmware versions earlier than M35M1_V250922.
Real-world impact
An attacker can execute any command with root privileges on the router, potentially taking full control, stealing data, or using the device as a launch point for further attacks.
Why this severity
The CVSS score of 9.3 reflects the vulnerability’s high impact: it allows remote attackers to gain full root access without authentication, with no mitigations required. The lack of authentication, user interaction, or privilege escalation barriers makes it a critical risk.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources