WAVLINK sync_server Unauthenticated Arbitrary File Write (CVE-2026-89009)

Technical Analysis

The sync_server daemon runs as root and parses a 100-byte filename field in its protocol header without validating or canonicalizing the path, permitting attackers to supply absolute paths (e.g., '../' traversal or direct '/etc/' targets) to overwrite startup scripts, cron jobs, or credential files. Because no authentication is required and the service listens on TCP 13136 by default, exploitation requires only network reachability to the device, making it attractive for mass scanning and botnet recruitment (e.g., Mirai-style campaigns). Successful exploitation grants persistent root-level control, allowing attackers to install backdoors, redirect DNS, intercept traffic, or pivot into internal networks behind the router. Organizations that deploy AI agents or LLM-powered automation on networks behind these routers face risk of traffic interception, credential theft (including API keys used by agents to reach cloud LLM or tool endpoints), and man-in-the-middle manipulation of agent tool-calling traffic if the compromised router sits on the network path.

Affected Systems

WAVLINK WN535M1 and WN535M3 wireless routers with firmware versions prior to M35M1_V250922; sync_server daemon listening on TCP port 13136.

Indicators of Compromise

• TCP port 13136 (sync_server service)
• Anomalous inbound connections to sync_server with oversized/malformed 100-byte filename headers
• Modified/overwritten startup scripts or credential store files on WAVLINK devices
• Unexpected root-owned file writes outside standard configuration directories

Remediation Steps

1. 1

   Apply firmware update

   Upgrade all affected WAVLINK WN535M1/WN535M3 devices to firmware M35M1_V250922 or later, which addresses the path canonicalization flaw.

2. 2

   Restrict network exposure

   Block inbound access to TCP port 13136 at the network perimeter and disable WAN-facing management/sync services unless explicitly required.

3. 3

   Network segmentation

   Isolate IoT and consumer-grade networking devices from critical infrastructure, servers, and systems running AI agent or automation workloads.

4. 4

   Monitor for indicators

   Deploy network monitoring to detect anomalous traffic to port 13136 and unexpected file modifications or reboots on affected devices.

5. 5

   Credential rotation

   If compromise is suspected, rotate all credentials and API keys that may have transited the affected network, including those used by AI agents or automation tools.