CyberRota Analysis
AI-GeneratedWAVLINK WN535M1 and WN535M3 routers with firmware versions earlier than M35M1_V250922 are vulnerable to an unauthenticated arbitrary file write flaw, enabling remote attackers to overwrite critical files by exploiting the sync_server daemon on TCP port 13136. This vulnerability, which operates without authentication and runs with root privileges, poses a significant risk of persistent system compromise, including the potential manipulation of startup scripts and credential stores. Organizations using these affected routers should prioritize immediate updates to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header without path canonicalization, allowing attackers to supply an absolute path and write arbitrary content to overwrite startup scripts or credential stores to achieve persistent system compromise.