By sending a specially crafted 100-byte payload to the target device, a remote attacker can specify absolute file paths to overwrite critical system files. This enables the modification of startup scripts, configuration files, or credential stores. Successful exploitation grants an attacker persistent root-level access to the affected routing infrastructure, which can be utilized for traffic interception, credential harvesting, or as a pivot point for further lateral movement within the network. Defenders should prioritize patching and ensure that management interfaces and daemon ports are not exposed to untrusted networks.

Impact

Successful exploitation of this vulnerability results in full administrative (root) control over the affected WAVLINK networking hardware. An attacker can achieve persistence, modify routing tables to intercept traffic, or extract device credentials, potentially leading to widespread compromise of the internal network segment connected to the router. As these devices are typically internet-facing edge components, the potential for mass exploitation by automated scanning is high.

Recommendation

• Upgrade the firmware on all WAVLINK WN535M1 and WN535M3 devices to version M35M1_V250922 or later to address CVE-2026-89009.
• Apply network-level access control to restrict access to TCP port 13136, ensuring that the sync_server daemon is not reachable from the public internet or untrusted internal zones.
• Monitor network traffic for anomalous outbound connections originating from router infrastructure, which may indicate post-exploitation activity or C2 communication following a successful file overwrite.