CVE-2026-89009: WAVLINK Router Auth Bypass Vulnerability

CVE-2026-89009 is an authentication bypass flaw in WAVLINK WN535M1 and WN535M3 routers allowing unauthenticated remote attackers to write arbitrary files and achieve persistent system compromise. This article covers technical details, affected firmware versions, security impact, and mitigation strategies.

CVE-2026-89009 Overview

CVE-2026-89009 is an unauthenticated arbitrary file write vulnerability affecting WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922. The flaw resides in the sync_server daemon, which listens on TCP port 13136 and runs as root without authentication. The daemon accepts a 100-byte filename field in its protocol header without performing path canonicalization. Remote attackers can supply an absolute path in the filename field to overwrite arbitrary files, including startup scripts and credential stores. Successful exploitation enables persistent system compromise and full device takeover. The weakness is categorized as [CWE-36] Absolute Path Traversal.

Critical Impact
Unauthenticated remote attackers can overwrite any file on affected WAVLINK routers as root, enabling persistent compromise and full device takeover.

Affected Products

WAVLINK WN535M1 routers running firmware prior to M35M1_V250922
WAVLINK WN535M3 routers running firmware prior to M35M1_V250922
The vulnerable sync_server daemon listening on TCP port 13136

Discovery Timeline

2026-09-11 - CVE-2026-89009 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-89009

Vulnerability Analysis

The sync_server daemon on affected WAVLINK routers exposes a custom binary protocol on TCP port 13136. The protocol header includes a 100-byte filename field used to determine where incoming payload data is written on disk. The daemon does not enforce authentication, and it does not canonicalize or validate the filename before opening the target path. Because the process executes with root privileges, any file writable by the operating system can be replaced. Attackers can target /etc/passwd, /etc/shadow, boot scripts under /etc/init.d/, or credential stores used by the web management interface. Overwriting these files yields persistent root access across reboots. See the VulnCheck Advisory for Wavlink for the full technical write-up.

Root Cause

The root cause is the absence of path canonicalization and input validation on the filename field of the sync_server protocol header. The daemon treats the 100-byte value as a trusted destination path and opens it directly for writing. Combined with the lack of authentication and root execution context, this design flaw permits unrestricted file overwrite from the network.

Attack Vector

Exploitation requires only network reachability to TCP port 13136 on the router. An attacker crafts a protocol frame containing an absolute path such as /etc/init.d/rcS in the filename field and appends malicious payload bytes. The daemon writes the payload to the specified location, replacing the original contents. A reference proof of concept is published at the GitHub RCE Proof of Concept.

Detection Methods for CVE-2026-89009

Indicators of Compromise

Inbound TCP connections to port 13136 on WAVLINK WN535M1 or WN535M3 devices from untrusted sources.
Unexpected modifications to /etc/passwd, /etc/shadow, or scripts under /etc/init.d/ on affected routers.
New or altered credential store files consumed by the router's web management interface.
Router reboots followed by the appearance of unfamiliar processes or listening services.

Detection Strategies

Monitor network telemetry for connections to TCP port 13136 on WAVLINK infrastructure and alert on traffic originating outside the management network.
Compare firmware file hashes against known-good baselines from M35M1_V250922 to identify tampering.
Inspect router syslog output for sync_server write operations targeting sensitive paths.

Monitoring Recommendations

Ingest router logs and network flow data into a centralized analytics platform for correlation with external scanning activity.
Track outbound connections from routers to unfamiliar hosts, which may indicate post-exploitation callbacks.
Alert on administrative account changes or new SSH keys appearing on managed WAVLINK devices.

How to Mitigate CVE-2026-89009

Immediate Actions Required

Upgrade WN535M1 and WN535M3 firmware to M35M1_V250922 or later as soon as the vendor makes it available. Consult the Wavlink Documentation for release notes.
Block inbound access to TCP port 13136 at the network perimeter and on any interface exposed to untrusted networks.
Audit affected devices for signs of file tampering and re-image any router suspected of compromise.

Patch Information

WAVLINK addresses CVE-2026-89009 in firmware version M35M1_V250922. The fix removes the unauthenticated arbitrary write behavior in the sync_server daemon. Refer to the VulnCheck Advisory for Wavlink for vendor coordination details.

Workarounds

Restrict TCP port 13136 to trusted management subnets using upstream firewall rules until firmware can be applied.
Disable remote WAN administration and place router management interfaces on an isolated VLAN.
Replace affected WN535M1 and WN535M3 devices if firmware updates are not available for your regional SKU.

bash

# Example upstream firewall rule to block sync_server exposure
iptables -A FORWARD -p tcp --dport 13136 -j DROP
iptables -A INPUT   -p tcp --dport 13136 -j DROP