Description

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync_server daemon on TCP port 13136. The daemon interpolates attacker-controlled filename input containing shell metacharacters into a shell command string via sprintf() and passes it to system() without sanitization, enabling root-level command execution on the device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T15:17:08.357Z",
  "pubdate": "2026-09-11T15:17:08.357Z",
  "executiveSummary": "The WAVLINK WN535M1 and WN535M3 routers are susceptible to an unauthenticated OS command injection vulnerability residing within the sync_server daemon.\nThis critical flaw permits remote, unauthenticated attackers to execute arbitrary system commands with root-level privileges.\nThe vulnerability stems from improper input validation where user-supplied data is directly concatenated into shell commands.\nSuccessful exploitation results in complete compromise of the router's operating system, potentially leading to unauthorized data access, persistence establishment, or integration of the device into a botnet.\nGiven that the service operates on TCP port 13136 and requires no prior authentication, the attack surface is exposed to any network-adjacent actor capable of communicating with the vulnerable service.\nUsers are at high risk until firmware is updated to versions M35M1_V250922 or later.",
  "technicalDetails": "The root cause of this vulnerability is a lack of input sanitization within the sync_server daemon, which handles network-based file synchronization requests on TCP port 13136.\nThe application processes filename parameters by interpolating them into a formatted string via the sprintf() function. This resulting string is subsequently passed to the system() function for execution.\nBecause the input is not sanitized to remove or escape shell metacharacters (such as ';', '&', '|', or '`'), an attacker can inject arbitrary shell commands directly into the command execution stream.\nThe attack flow begins with the attacker establishing a TCP connection to the sync_server on port 13136. The attacker then crafts a malicious request payload containing a filename field injected with OS command sequences.\nWhen the daemon receives this request, it triggers the vulnerable sprintf() routine, embedding the attacker's payload into the shell command string. Upon invoking system(), the shell interprets the injected characters, executing the attacker's secondary commands with the same security context as the daemon itself.\nBecause the sync_server process operates with root privileges, the executed commands inherit this level of access, effectively bypassing all system security controls.\nThis vulnerability is classified as remote, as it does not require local access or authenticated user sessions to trigger. The exposure of TCP port 13136 to a network interface allows for reliable exploitation by any attacker capable of initiating a standard TCP handshake with the target router.\nThe post-exploitation impact includes the potential for persistent backdoors, modification of device configuration, exfiltration of sensitive network data, and the ability to pivot into the local area network (LAN) from the compromised router."
}