External risk intelligence

WAVLINK Router Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-89010

The vulnerability affects consumer-grade routers, which are network-edge devices. The affected service runs on a specific TCP port and is reachable remotely. While these devices are typically deployed at the network edge, the specific daemon is not necessarily a standard public-facing service, leading to a classification of likely reachable rather than design-intended public access.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in WAVLINK routers, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges. This is achieved by sending specially crafted filenames to a specific service on the router, which then interpolates the input into a command without proper sanitization. The concern is for any organization using these devices, as the exposure could allow for significant compromise of the network edge.

Unauthenticated remote command execution on routers.
Root-level access could compromise network edge.
Confirm relevance and assess exposure of affected devices.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component by sending specially crafted filenames to the `sync_server` daemon, which listens on TCP port 13136. This daemon processes filenames without proper sanitization, allowing attackers to inject arbitrary commands that are then executed with root privileges on the affected router.

Unauthenticated network access required.
Crafted filenames sent to `sync_server`.
Arbitrary command execution as root.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands with root privileges on affected WAVLINK routers. This could occur when an attacker sends specially crafted filenames to the `sync_server` daemon.

Root-level access to the router.
Remote command execution via crafted filenames.
Complete compromise of the network device.

Operational Fix

Recommended remediation, mitigation, and detection steps

Compromised WAVLINK routers present a critical risk due to unauthenticated remote command injection. Infrastructure and network security teams are likely responsible for managing these devices. The immediate priority is to identify all affected devices within the environment, assess their exposure, and confirm business criticality before planning remediation.

Infrastructure and security teams own this.
Verify router reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WAVLINK WN535M1 and WN535M3 router?

These are consumer-grade networking devices designed to provide internet connectivity, typically acting as the boundary between a local network and the public internet. They manage traffic routing and security functions for homes or small office setups. The vulnerability specifically involves firmware running on these models, which handles synchronization tasks through a dedicated internal process.

What does OS command injection mean for CVE-2026-89010?

This vulnerability, classified as CWE-78 (OS Command Injection), occurs when a program passes untrusted data—in this case, filenames—to a system shell without cleaning it first. Because the router does not verify this input, an attacker can insert their own system commands alongside the filename. These commands then run with root privileges, giving the attacker full control over the device's operating system.

How is this command injection triggered?

An attacker triggers the vulnerability by sending a specially crafted filename to the sync_server daemon listening on TCP port 13136. Simply communicating with the router's web interface or other services does not trigger the bug; the malicious input must reach this specific synchronization service. The daemon incorrectly treats the filename as part of an executable command string, which leads to unauthorized execution.

Who should be concerned about this vulnerability?

Anyone using these specific WAVLINK models should care, as Halo Surface Signal identifies these as network-edge devices. While the sync_server is not a typical public-facing service like a web server, its presence on an edge device makes it potentially reachable from the internet. If your router is directly exposed to external traffic, the risk of unauthenticated remote access is significantly higher.

What is the first step to address this risk?

Start by identifying all deployed WAVLINK WN535M1 or WN535M3 routers in your network environment. Check their current firmware versions to see if they are older than M35M1_V250922. Once you have an inventory, assess which devices are exposed to the internet and determine their importance to your network. This information will help you prioritize which routers need firmware updates or further restriction to reduce the likelihood of unauthorized access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.