A critical flaw in the WAVLINK WN535M1 and WN535M3 sync_server daemon lets remote, unauthenticated attackers overwrite arbitrary files on the device as root, scoring CVSS 3.1 9.1.
What Is It
WAVLINK WN535M1 and WN535M3 routers running firmware prior to the September 2026 release expose an unauthenticated arbitrary file write vulnerability in the sync_server daemon listening on TCP port 13136. The daemon runs as root and requires no authentication. Its protocol header includes a 100-byte filename field that is accepted without path canonicalization, so an attacker can supply an absolute path and write arbitrary content anywhere on the filesystem.
The issue is tracked as CWE-36 (Absolute Path Traversal). VulnCheck assigns a CVSS 3.1 base score of 9.1 (CRITICAL, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) and a CVSS 4.0 score of 8.8 (HIGH). Impact is integrity and availability; confidentiality impact is rated none.
Why It Matters
Exploitation requires no credentials, no user interaction, and low attack complexity over the network. Because the writing process runs as root, an arbitrary write of this kind would plausibly let an attacker target startup scripts or credential stores, which could yield persistence across reboot on a device sitting at the network edge; though the advisory does not document a demonstrated persistence chain.
A public write-up and proof-of-concept repository for the sync_server issue is referenced in the advisory, lowering the bar for weaponization.
The CVE carries the unsupported-when-assigned tag, indicating the affected products were outside vendor support at assignment time.
What's Vulnerable
- WAVLINK WN535M1: firmware
M35M1_V210223(affected);M35M1_V250922(unaffected) - WAVLINK WN535M3: affected in firmware prior to the September 2026 release; the advisory's versioned firmware strings carry the
M35M1_prefix and no distinct WN535M3 build identifier is listed
The exposure point is the sync_server daemon on TCP port 13136.
Patch Status
Firmware M35M1_V250922 is listed as unaffected; versions prior to it are vulnerable. Owners of the WN535M3 should confirm the corresponding fixed build with the vendor, since the advisory does not enumerate a separate version string for that model. Published 2026-09-11; NVD status is Deferred.