Read the docs
TI-2026-60326 Aliases CVE-2026-89010GHSA-22gq-jjvp-2jc9

WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server

Priority HIGH 81CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync_server daemon on TCP port 13136. The daemon interpolates attacker-controlled filename input containing shell metacharacters into a shell command string via sprintf() and passes it to system() without sanitization, enabling root-level command execution on the device.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03168 88th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed WN535M1 (WAVLINK Technology): M35M1_V250922WN535M3 (WAVLINK Technology): M35M1_V250922

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WavlinkWN535M1M35M1_V210223M35M1_V250922Patch availableCNA
WavlinkWN535M3M35M1_V210223M35M1_V250922Patch availableCNA
  • WN535M1 VendorWavlink Affected M35M1_V210223 Fixed in M35M1_V250922 Patch available CNA
  • WN535M3 VendorWavlink Affected M35M1_V210223 Fixed in M35M1_V250922 Patch available CNA

Remediation

  • Fix · CNA WN535M1 (WAVLINK Technology) Fixed in M35M1_V250922
  • Fix · CNA WN535M3 (WAVLINK Technology) Fixed in M35M1_V250922

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-89010
  2. 2026-10-03 Alias added: GHSA-22gq-jjvp-2jc9
  3. 2026-10-29 1 new reference · CNA

References

Exploit 1

Patch 1

  • TI-2022-02298 WAVLINK WN535K2/WN535K3 nightled.cgi os command injection CVSS 3.1CRITICAL 9.8
  • TI-2026-83752 OS command injection in WAVLINK WN551X3-A DNS resolution handler CVSS 4.0CRITICAL 10.0
  • TI-2026-83751 WAVLINK WN551X3-A WireGuard CLI Group ioos os command injection CVSS 4.0CRITICAL 10.0
  • TI-2026-83668 Stack-based overflow in WAVLINK WN536AX6-A OpenVPN handler CVSS 4.0CRITICAL 10.0
  • TI-2026-83667 OS command injection in WAVLINK WN536AX6-A WireGuard handler CVSS 4.0CRITICAL 10.0
  • TI-2026-83666 OS command injection in WAVLINK WN536AX6-A openvpn_cli handler CVSS 4.0CRITICAL 10.0
See all 248 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences