Description

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header without path canonicalization, allowing attackers to supply an absolute path and write arbitrary content to overwrite startup scripts or credential stores to achieve persistent system compromise.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-11T15:17:08.190Z",
  "pubdate": "2026-09-11T15:17:08.190Z",
  "executiveSummary": "WAVLINK WN535M1 and WN535M3 routers running firmware versions prior to M35M1_V250922 are susceptible to an unauthenticated arbitrary file write vulnerability.\nThe vulnerability resides within the sync_server daemon, which listens on TCP port 13136 and operates with root-level privileges.\nBy transmitting a specifically crafted payload to the sync_server, a remote, unauthenticated attacker can overwrite arbitrary files on the underlying filesystem.\nThe lack of input validation and path canonicalization within the daemon’s protocol header enables directory traversal and absolute path injection.\nSuccessful exploitation results in full system compromise, as an attacker can overwrite critical configuration files, authentication stores, or initialization scripts to achieve persistence.\nDue to the lack of required authentication and the daemon's root execution context, this vulnerability poses a critical risk to the confidentiality, integrity, and availability of the affected hardware.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation and the absence of path canonicalization within the sync_server daemon processing logic on TCP port 13136.\nThe protocol implementation accepts a 100-byte filename field within its header structure without verifying that the supplied path is constrained to a designated directory or safe storage area.\nBecause the sync_server daemon runs with root privileges, the application process maintains the authority to modify any file on the device's read-write filesystem.\nExploitation follows a predictable sequence: First, the attacker initiates a TCP connection to the target device on port 13136. Second, the attacker constructs a network packet containing a malicious header where the 100-byte filename field is populated with an absolute path—for example, '/etc/passwd' or a startup script located in '/etc/init.d/'.\nThird, the sync_server daemon reads the filename field and, lacking sanitization mechanisms such as a chroot jail or path validation functions, treats the input as a legitimate destination for the subsequent data stream provided in the payload.\nFourth, the attacker transmits the arbitrary data content intended for the target file. The daemon writes this data directly to the specified absolute path, effectively overwriting or corrupting system files.\nThe impact of this behavior is catastrophic from a security perspective. By targeting startup scripts, an attacker can inject malicious shell commands that execute upon system reboot, ensuring permanent access. Alternatively, overwriting credential stores allows an attacker to manipulate user accounts, inject new administrative credentials, or disable security mechanisms entirely.\nThe vulnerability is remotely exploitable over the network, requiring no prior authentication or physical access, making it highly attractive for automated exploitation attempts and botnet recruitment."
}