WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server (CVE-2026-89010) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-89010

WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server

Answer in brief

CVE-2026-89010 records a Unknown severity vulnerability in WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server. The current sources do not mark it as known exploited. The current feed maps WAVLINK Technology/WN535M1 (generic), WAVLINK Technology/WN535M3 (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 11, 2026Updated Sep 11, 2026Source checked Sep 11, 2026First seen by HOL Sep 11, 2026Material review Sep 11, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Not reported

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps WAVLINK Technology/WN535M1 (generic), WAVLINK Technology/WN535M3 (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
WAVLINK Technology/WN535M1generic	M35M1_V210223	Not reported
WAVLINK Technology/WN535M3generic	M35M1_V210223	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for WAVLINK Technology/WN535M1, WAVLINK Technology/WN535M3.
Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 11, 2026

Sources and claim methodology

Upstream source description

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync_server daemon on TCP port 13136. The daemon interpolates attacker-controlled filename input containing shell metacharacters into a shell command string via sprintf() and passes it to system() without sanitization, enabling root-level command execution on the device.

Quoted source text, attributed separately from HOL analysis.