EUVD-2026-76129
GHSA-pg3c-cqw3-4pgg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable root daemon, zero authentication; scope changed because persistent router compromise affects all downstream networked hosts.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header without path canonicalization, allowing attackers to supply an absolute path and write arbitrary content to overwrite startup scripts or credential stores to achieve persistent system compromise.
AnalysisAI
Unauthenticated arbitrary file write in WAVLINK WN535M1 and WN535M3 routers (firmware before M35M1_V250922) exposes any file on the device to remote overwrite via the sync_server daemon on TCP port 13136, which runs as root and performs no client authentication. The daemon's 100-byte protocol filename field lacks path canonicalization, allowing absolute path traversal (CWE-36) that enables attackers to overwrite startup scripts or credential stores and achieve persistent root-level compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The sync_server daemon must be running on TCP port 13136, which is part of the standard firmware on affected WN535M1 and WN535M3 devices - no special configuration is required to expose the vulnerable service on the LAN. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H) accurately reflects the network-reachable, zero-authentication, low-complexity attack surface with high integrity and availability impact on the router itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade affected WN535M1 and WN535M3 router firmware to version M35M1_V250922 or later; consult WAVLINK's documentation at https://docs.wavlink.xyz/ and the VulnCheck advisory at https://www.vulncheck.com/advisories/wavlink-wn535m1-wn535m3-unauthenticated-arbitrary-file-write-via-sync-server for upgrade procedures. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WAVLINK WN535M1 and WN535M3 devices and identify those running firmware versions prior to M35M1_V250922. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-36 – Absolute Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today