CVE-2026-89009

Executive Summary

CVE-2026-89009 is an unauthenticated arbitrary file write vulnerability in Wavlink WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922. The sync_server daemon, which listens on TCP port 13136, runs as root, requires no authentication, and accepts a 100-byte filename field in its protocol header without path canonicalization — allowing a remote attacker to supply an absolute path and overwrite any file on the device, including startup scripts and credential stores.

Rated CVSS 9.1 (Critical), the integrity and availability impact is High while confidentiality impact is None, reflecting a write primitive rather than a read primitive. No public PoC, Nuclei template, or exploit code has been observed, and the CVE is not listed in CISA KEV. However, the combination of root execution, zero authentication, and a trivial network-reachable surface (TCP 13136) makes this a high-priority target for Internet-exposed consumer and SOHO routers, where persistent compromise is achievable by overwriting startup logic that re-executes on every reboot.

Technical Analysis

Vulnerability Class

CVE-2026-89009 is classified as CWE-36, Absolute Path Traversal. Unlike relative traversal (CWE-22, ../ sequences), CWE-36 occurs when an application accepts a user-supplied filename and fails to reject or normalize an absolute path. The attacker does not need to escape a directory — they simply supply a fully qualified path such as /etc/init.d/rcS or a credential store, and the application writes the attacker-controlled content to that exact location.

Attack Surface

The exposed surface is the sync_server daemon listening on TCP port 13136. Per the NVD description:

• The daemon runs as root — any file written inherits root privileges.
• The daemon requires no authentication — no pre-shared key, session token, or source-IP allowlist is described.
• The daemon accepts a 100-byte filename field in its protocol header.
• The daemon performs no path canonicalization on that filename field.

This means the protocol itself carries the vulnerability: the filename field is treated as a trusted path rather than an untrusted input requiring validation against a fixed base directory.

Mechanism

1. A client connects to TCP port 13136 and speaks the sync_server protocol.
2. The protocol header contains a fixed-width 100-byte filename field.
3. Because the daemon does not canonicalize or constrain the field, an attacker supplies an absolute path (e.g., a startup script or credential store path) rather than a benign basename.
4. The daemon, running as root, opens the attacker-supplied path and writes attacker-supplied content.

The 100-byte fixed field is significant: it bounds the writable path length but is more than sufficient to reference standard firmware locations such as init scripts, NVRAM backup paths, or credential files. The write is arbitrary in both path and content — the NVD description states the attacker can "write arbitrary content to overwrite startup scripts or credential stores."

Why This Is Critical Despite "I:H/A:H, C:N"

The CVSS vector S:U/C:N/I:H/A:H is often misread as "no confidentiality impact, therefore low priority." In practice:

• Integrity High — arbitrary file overwrite means an attacker controls any writable file on the filesystem.
• Availability High — overwriting startup scripts can render the device unbootable (bricking), which is an availability loss.
• Confidentiality None (directly) — the reported primitive is a write, not a read. However, in the post-exploitation phase, an attacker can typically use the write primitive to disable security controls or plant logic that later exfiltrates data — indirect confidentiality loss is common but was not scored.

Persistence is achieved by overwriting files that the device re-reads on boot. This converts a single-session network write into a reboot-surviving implant, which is materially worse than a one-shot memory corruption.

Exploitation Scenarios

Note: No public PoC exists. The attack chain below is inferred from the NVD description and the CWE-36 vulnerability class. Function names, protocol opcodes, and exact file paths are deliberately not fabricated; only the elements explicitly stated in the NVD description are used.

1. Reconnaissance / Target Identification

An attacker scans for hosts exposing TCP port 13136, the sync_server daemon's listening port. Because the daemon is unauthenticated, a TCP connect that reaches the service is sufficient to confirm reachability. Publicly indexed SOHO/CONSUMER router ranges and Shodan-style dorks for the Wavlink brand (see SHODAN_DORKS) narrow the candidate set. Affected models are WN535M1 and WN535M3; firmware version must be prior to M35M1_V250922.

2. Triggering the Flaw

The attacker sends a crafted payload to sync_server on TCP port 13136. The payload's protocol header carries a filename value in the 100-byte filename field. Because no canonicalization is performed, the attacker supplies an absolute path instead of a benign basename. No credentials or prior session are required — the daemon accepts the connection and processes the header.

3. Payload / Execution Method

The attacker pairs the absolute-path filename with arbitrary content. The daemon writes that content to the target path as root. Two high-value target classes are named in the NVD description: startup scripts and credential stores.

• Startup scripts — overwriting a boot-invoked script means attacker payload re-runs on every power cycle, yielding persistence.
• Credential stores — overwriting a credential file can enable authentication bypass or lockout, depending on firmware logic.

The primitive itself is a write; code execution depends on which file is overwritten and whether that file is later interpreted (e.g., by a shell or boot loader). The NVD description explicitly describes "persistent system compromise" as the outcome — that is the intended blast radius, not merely a transient file modification.

4. Post-Exploitation Impact

With root-level arbitrary write and persistence, the attacker can:

• Establish a reboot-surviving implant by overwriting a startup script.
• Disable or weaken authentication by overwriting credential stores.
• Pivot from the router into the downstream LAN, since the router is the trust boundary for connected clients.
• Brick the device (Availability High) by corrupting boot-critical files.

No threat-actor attribution, C2 infrastructure, or in-the-wild exploitation has been reported for this CVE at the time of writing.

Impact Assessment

Blast radius: The router is a network chokepoint. Compromise of the router exposes every client behind it — home users, small offices, and any environment where these models are deployed. Because the impact is S:U, the CVSS framework does not score downstream LAN compromise, but the operational reality is that a root-level router implant is a foothold into the entire downstream network.

Business impact: SOHO and consumer router fleets are frequently unmanaged, unpatched, and Internet-exposed. A reboot-surviving root write primitive on such a device is a classic persistence vector for botnet recruitment, traffic redirection, and credential harvesting. The absence of a confirmed patch (0/4 confidence) means the exposure window remains open.

Exploitability ecosystem:

• EPSS: not yet scored by FIRST.org — no probability estimate available.
• CISA KEV: not listed.
• Public PoC: none observed. Exploit code: none observed.
• Nuclei template: none observed.

These factors lower the current likelihood of mass exploitation, but the low skill floor (crafted payload to a known port) and high impact justify urgent remediation.

Detection Guidance

Because no public PoC exists, the rules below target the vulnerability class — unauthenticated writes to the sync_server daemon on TCP 13136 — and use only fields grounded in the NVD description (port, protocol header, filename/path semantics).

Sigma Rule

title: Wavlink WN535M1/WN535M3 sync_server Unauthenticated Arbitrary File Write (CVE-2026-89009)
id: 9b2f4c1e-8900-4a7b-9d3e-cve202689009
status: experimental
description: Detects network connections to TCP port 13136 associated with the Wavlink sync_server daemon on WN535M1/WN535M3 routers, which allows unauthenticated arbitrary file writes.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-89009
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: windows
detection:
  selection_port:
    DestinationPort: 13136
  selection_proc:
    Image|endswith:
      - '\curl.exe'
      - '\wget.exe'
      - '\python.exe'
      - '\nc.exe'
      - '\ncat.exe'
  condition: selection_port and selection_proc
fields:
  - SourceIp
  - DestinationIp
  - DestinationPort
  - Image
falsepositives:
  - Legitimate vendor sync utilities communicating with Wavlink devices
  - Network inventory or vulnerability scanners
level: high
tags:
  - attack.t1190
  - cve.2026.89009

YARA Rule

rule CVE_2026_89009_Wavlink_sync_server_FileWrite
{
    meta:
        description = "Detects payloads targeting Wavlink WN535M1/WN535M3 sync_server arbitrary file write (CVE-2026-89009)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-89009"
        cve = "CVE-2026-89009"

    strings:
        // Absolute path indicators within a 100-byte filename-style field
        $abs_etc    = "/etc/"
        $abs_tmp    = "/tmp/"
        $abs_var    = "/var/"
        $abs_init   = "/etc/init.d/"
        $abs_rcs    = "rcS"
        $abs_passwd = "passwd"

    condition:
        uint32be(0) == 0x00000000 or true
        and 2 of ($abs_*)
}

Note: The uint32be(0) == 0x00000000 or true construction keeps the rule permissive because the exact sync_server message framing is not publicly documented. Anchoring on absolute-path substrings inside a bounded filename field reflects the CWE-36 class without asserting an undocumented header layout.

Suricata IDS Rule

alert tcp any any -> any 13136 ( \
  msg:"CVE-2026-89009 Wavlink WN535M1/WN535M3 sync_server Unauthenticated Arbitrary File Write Attempt"; \
  flow:established,to_server; \
  content:"/etc/"; offset:0; depth:100; \
  content:"/"; within:100; \
  classtype:attempted-admin; \
  reference:cve,2026-89009; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-89009; \
  metadata:affected_product Wavlink_WN535M1_WN535M3, attack_target IoT, created_at 2026_01_01; \
  sid:202689009; rev:1; )

Rationale: The write is triggered by an absolute path in the 100-byte filename field. Matching /etc/ at depth 100 on a connection to TCP 13136 captures the CWE-36 signature without fabricating protocol opcodes.

Elastic EQL Detection

sequence by source.ip with maxspan=30s
  [network where destination.port == 13136 and event.action == "connection_attempted"]
  [network where destination.port == 13136 and network.bytes > 0 and event.action == "connection_accepted"]

Complement with a process-side rule if endpoint telemetry shows utilities (curl, wget, python, nc) initiating TCP 13136 sessions to non-inventory destinations.

Splunk SPL Query

index=network OR index=firewall (dest_port=13136 OR dpt=13136)
| eval is_write_path = if(match(_raw, "(?i)(/etc/|/tmp/|/var/|init\.d|rcS|passwd)"), 1, 0)
| stats count min(_time) as first_seen max(_time) as last_seen dc(src_ip) as src_count
        values(src_ip) as sources values(dest_ip) as destinations
        by dest_port is_write_path
| where is_write_path=1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

For environments that log full payloads, additionally search for /etc/ at the start of a session on TCP 13136 to align with the Suricata content match.

Wazuh OSSEC Rule

<group name="wavlink,cve-2026-89009,">
  <rule id="202689009" level="12">
    <decoded_as>json</decoded_as>
    <field name="dstport">^13136$</field>
    <description>CVE-2026-89009: Connection to Wavlink WN535M1/WN535M3 sync_server (TCP 13136) - possible unauthenticated arbitrary file write</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,cve_2026_89009,</group>
  </rule>

  <rule id="202689010" level="14">
    <if_sid>202689009</if_sid>
    <field name="payload">/etc/</field>
    <description>CVE-2026-89009: Absolute-path payload observed on sync_server (TCP 13136) - likely arbitrary file write attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,cve_2026_89009,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; no vendor advisory confirmed; no OSV packages; no CISA KEV entry. The firmware build M35M1_V250922 is named in the NVD description as the post-fix baseline, but no distribution or advisory has been verified as an authoritative patch artifact. Plan as if no patch exists.

1. Immediate Mitigations

• Block TCP port 13136 at the network edge. This is the single highest-value action. The sync_server daemon does not need to be reachable from untrusted networks; restrict it to a management VLAN or disable remote access entirely.
• Disable the sync_server service if the firmware exposes a management toggle. Where no toggle exists, isolate the device behind a firewall rule dropping inbound traffic to TCP 13136.
• Segment affected routers so that a compromise cannot pivot into production networks.
• Monitor for inbound connections to TCP 13136 on WN535M1/WN535M3 devices (see Detection Guidance).

2. Patch / Upgrade Steps

• No confirmed patch is available. Do not assume that upgrading to any specific build remediates the issue until a vendor advisory confirms it.
• Contact Wavlink support to obtain the M35M1_V250922 firmware or later and a written statement that it fixes CVE-2026-89009. Verify the firmware hash/signature before deployment.
• If the device cannot be updated or isolated, decommission and replace it with a model under active vendor maintenance.

3. Long-Term Hardening

• Inventory all Wavlink WN535M1/WN535M3 devices and record firmware versions; treat any device below M35M1_V250922 as untrusted.
• Default-deny inbound management ports on all SOHO/CONSUMER routers. Daemons that run as root should never be Internet-reachable without authentication.
• Require authenticated, canonicalized path handling in any vendor firmware evaluation: filenames must be resolved against a fixed base directory and rejected if the canonical path escapes it (CWE-36/CWE-22 defense).
• Vendor lifecycle management: avoid SOHO hardware without a documented, verifiable patch cadence. CVE-2026-89009 is a reminder that unauthenticated root daemons are a recurring failure mode in consumer firmware.
• Detection coverage: retain the Sigma/YARA/Suricata/Elastic/Splunk/Wazuh rules above and tune them to your environment's noise profile (inventory scanners and legitimate sync utilities are expected false positives).

References

1. NVD — CVE-2026-89009: https://nvd.nist.gov/vuln/detail/CVE-2026-89009
2. MITRE CWE-36 — Absolute Path Traversal: https://cwe.mitre.org/data/definitions/36.html
3. FIRST EPSS — CVE-2026-89009 (not yet scored at time of writing): https://api.first.org/data/v1/epss?cve=CVE-2026-89009
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-89009 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. Wavlink product/support portal (for firmware M35M1_V250922 verification): https://www.wavlink.com/

Exploit-in-the-wild / threat actor evidence: None reported. No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing were observed at the time of writing. The attack chain in this report is inferred from the NVD description and the CWE-36 vulnerability class.