CVE-2026-89009
Received Received - Intake

Unauthenticated Arbitrary File Write in WAVLINK WN535M1 Router

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header without path canonicalization, allowing attackers to supply an absolute path and write arbitrary content to overwrite startup scripts or credential stores to achieve persistent system compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89009
EUVD
EUVD-2026-76129

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
wavlink wn535m1 to m35m1_v250922 (exc)
wavlink wn535m3 to m35m1_v250922 (exc)
wavlink wn535m1 to M35M1_V250922 (exc)
wavlink wn535m3 to M35M1_V250922 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-36 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-89009 is an unauthenticated arbitrary file write vulnerability in WAVLINK WN535M1 and WN535M3 routers with firmware prior to M35M1_V250922. The sync_server daemon on TCP port 13136 runs as root without authentication and accepts a 100-byte filename field. Attackers can supply absolute paths to overwrite any file, including startup scripts or credential stores, leading to persistent system compromise.

Detection Guidance

To detect this vulnerability, check if TCP port 13136 is open on your WAVLINK WN535M1 or WN535M3 router. Use network scanning tools like nmap to scan for open ports. Example command: nmap -p 13136 <router-ip>. If port 13136 is open, the device may be vulnerable.

Impact Analysis

This vulnerability allows remote attackers to fully compromise affected routers without credentials or user interaction. Attackers can overwrite critical files to gain root access, execute arbitrary commands, or maintain persistent control. Since the devices are often deployed as range extenders or mesh nodes, they may be reachable from LANs or guest networks, increasing exposure.

Mitigation Strategies

Immediately disable mesh mode on the router to prevent access to port 13136. Block TCP port 13136 at your network boundary using a firewall. If possible, upgrade the firmware to version M35M1_V250922 or later. Avoid exposing the router to untrusted networks like guest networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89009. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart