Which versions of WAVLINK WN535 are affected by CVE-2026-89009?

WAVLINK router models WN535M1 and WN535M3 contain an unauthenticated remote vulnerability that allows attackers to overwrite arbitrary files with root privileges, enabling persistent device…

How to fix or mitigate CVE-2026-89009?

Within 24 hours, inventory all WAVLINK WN535M1 and WN535M3 devices and identify those running firmware versions prior to M35M1_V250922. Initiate immediate firmware update to M35M1_V250922 or later across all affected routers, prioritizing devices in security-critical roles. Within 7 days, complete patching of all identified instances and conduct targeted forensic review of device configurations, startup scripts, and authentication logs to detect any unauthorized modifications or exploitation attempts. Within 30 days, establish a recurring firmware vulnerability assessment process for all network edge devices and restrict network access to TCP port 13136 if the sync_server service is not operationally required.

WAVLINK WN535 CVE-2026-89009

Q: What is the CVSS score of CVE-2026-89009?

CVE-2026-89009 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-76129 HIGH

Absolute Path Traversal (CWE-36)

2026-09-11 disclosure@vulncheck.com

GHSA-pg3c-cqw3-4pgg

8.8

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Network-reachable root daemon, zero authentication; scope changed because persistent router compromise affects all downstream networked hosts.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 11, 2026 - 15:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Sep 11, 2026 - 15:31 vuln.today

CVE Published

Sep 11, 2026 - 15:17 cve.org

HIGH 8.8

DescriptionCVE.org

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header without path canonicalization, allowing attackers to supply an absolute path and write arbitrary content to overwrite startup scripts or credential stores to achieve persistent system compromise.

AnalysisAI

Unauthenticated arbitrary file write in WAVLINK WN535M1 and WN535M3 routers (firmware before M35M1_V250922) exposes any file on the device to remote overwrite via the sync_server daemon on TCP port 13136, which runs as root and performs no client authentication. The daemon's 100-byte protocol filename field lacks path canonicalization, allowing absolute path traversal (CWE-36) that enables attackers to overwrite startup scripts or credential stores and achieve persistent root-level compromise. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The sync_server daemon must be running on TCP port 13136, which is part of the standard firmware on affected WN535M1 and WN535M3 devices - no special configuration is required to expose the vulnerable service on the LAN. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 base score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H) accurately reflects the network-reachable, zero-authentication, low-complexity attack surface with high integrity and availability impact on the router itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary fix is to upgrade affected WN535M1 and WN535M3 router firmware to version M35M1_V250922 or later; consult WAVLINK's documentation at https://docs.wavlink.xyz/ and the VulnCheck advisory at https://www.vulncheck.com/advisories/wavlink-wn535m1-wn535m3-unauthenticated-arbitrary-file-write-via-sync-server for upgrade procedures. … Detailed patch versions, workarounds, and compensating controls in full report.