Unauthenticated File Write Vulnerability in WAVLINK Routers
CVE-2026-89009

8.8HIGH

Key Information:

Vendor

Wavlink Technology

Status
Wn535m1
Wn535m3
Vendor
CVE Published:
11 September 2026

Badges

👾 Exploit Exists

What is CVE-2026-89009?

WAVLINK WN535M1 and WN535M3 routers have a significant vulnerability that allows unauthorized users to perform arbitrary file writes. The affected routers, running firmware versions prior to M35M1_V250922, feature a sync_server daemon that listens on TCP port 13136 and operates with root privileges. This daemon does not require authentication, making it exploitable by remote attackers. By sending a specifically crafted payload, attackers can overwrite files on the device, potentially including critical startup scripts and credential storage, enabling a pathway for persistent system compromise.

Affected Version(s)

WN535M1 M35M1_V210223

WN535M3 M35M1_V210223

WN535M1 M35M1_V250922

References

https://github.com/camdsmith/wavlink-sync_server-rce/blob...
technical-descriptionexploit
https://docs.wavlink.xyz/
productpatch
https://www.vulncheck.com/advisories/wavlink-wn535m1-wn53...
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Cameron Smith
.