WAVLINK WN535M1 and WN535M3 devices are susceptible to unauthenticated remote code execution with root privileges due to improper input sanitization in the sync_server daemon.

The sync_server daemon, which listens on TCP port 13136, fails to sanitize filename inputs containing shell metacharacters. This allows an unauthenticated remote attacker to inject arbitrary commands that are subsequently executed by the system with root-level privileges.

A successful exploit provides an attacker with complete control over the affected network device. This represents a critical risk, as attackers can use compromised routers to pivot into internal networks, intercept traffic, or establish persistent backdoors. Given the CVSS score of 9.8, the potential for total system compromise and the lack of required authentication necessitate immediate intervention to prevent unauthorized access and potential data breaches.

Immediate Action: Update firmware to version M35M1_V250922 using the vendor specified U-Boot recovery procedure. If updating is not immediately feasible, disable Mesh Mode to stop the sync_server daemon from binding to TCP port 13136.

Proactive Monitoring: Monitor network traffic for any unsolicited connections to TCP port 13136, which is typically used for mesh synchronization. Review system logs for anomalous command execution patterns or unexpected file creation events.

Compensating Controls: Block all inbound traffic to TCP port 13136 at the network perimeter or firewall level to prevent remote access to the vulnerable daemon.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the researcher's GitHub write-up.

The severity of this vulnerability, combined with the availability of a functional proof-of-concept, poses a significant risk to organizational security. Administrators should prioritize the mitigation of these devices, ideally through the recommended firmware update or by isolating the affected hardware from the network. Due to the inherent difficulty of the update process, network-level blocking of the associated port remains the most effective immediate defense for most environments.