Unauthenticated OS Command Injection in WAVLINK WN535M1 and WN535M3 Routers

Executive Summary

This is an unauthenticated OS command injection vulnerability in WAVLINK WN535M1 and WN535M3 routers with firmware before M35M1_V250922. The sync_server daemon on TCP port 13136 is vulnerable because it uses sprintf() to insert filenames into shell commands without sanitization before passing them to system(). Attackers can send crafted filenames with shell metacharacters to execute arbitrary commands as root remotely.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the sync_server daemon is running on TCP port 13136 on WAVLINK WN535M1 or WN535M3 routers. Use commands like 'nmap -p 13136 <target_IP>' to scan for the open port. If the port is open, verify the firmware version is prior to M35M1_V250922.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control of your router, allowing them to intercept network traffic, install malware, or use your device in botnets. Since the exploit requires no authentication, any device exposed to the internet with vulnerable firmware is at immediate risk.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the firmware to version M35M1_V250922 or later. If an update is not available, disable access to TCP port 13136 or block external connections to this port using a firewall.

Useful 0 Not Useful 0