WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync_server daemon on TCP port 13136. The daemon interpolates attacker-controlled filename input containing shell metacharacters into a shell command string via sprintf() and passes it to system() without sanitization, enabling root-level command execution on the device.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://docs.wavlink.xyz/Security_Advisory/WAVLINK-SA-2026-091302/ patch, vendor-advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.3 · wavlink technologyNVD modified 2026-10-29 17:46
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 3
- https://github.com/camdsmith/wavlink-sync_server-rce/blob/main/README.md technical-description, exploit
- https://docs.wavlink.xyz/Security_Advisory/WAVLINK-SA-2026-091302/ patch, vendor-advisory
- https://www.vulncheck.com/advisories/wavlink-wn535m1-wn535m3-unauthenticated-os-command-injection-via-sync-server third-party-advisory