Wavlink WNS35M1 sync_server Unauthenticated RCE Vulnerability Analysis & PoC

Summary of Unauthenticated Remote Code Execution Vulnerability in Wavlink Sync Server Vulnerability Overview Vulnerability Type: Unauthenticated Remote Root Code Execution Root Cause: The daemon listens on TCP port 13136 when mesh mode is enabled. It accepts arbitrary file transfer messages and fully trusts the filename field within the messages, without requiring any authentication. Two Distinct Issues: - Arbitrary File Write (CWE-36, CWE-306): An attacker can create or overwrite files at any absolute path. - OS Command Injection (CWE-78, CWE-306): Under specific conditions, the filename can trigger shell execution, enabling arbitrary command execution. CVSS Scores: - Command Injection: 9.8 (Critical) in CVSS 3.1, 9.3 (Critical) in CVSS 4.0 - Arbitrary File Write: 9.1 (Critical) in CVSS 3.1, 8.8 (High) in CVSS 4.0 Scope of Impact Affected Firmware: (confirmed) Affected Devices: Wavlink WNS35M1 / WNS35M3 (Halo Base Pro) Component: , TCP port 13136 Impact: Any network attacker with access to TCP port 13136 can gain full control of the device (root privileges). Remediation 1. Disable Mesh Mode: Stop from listening on TCP 13136, though this will disable mesh functionality. 2. Block Inbound TCP 13136: Block the port at the network boundary. 3. Upgrade Firmware to : The vendor has confirmed this version includes the fix, but the upgrade requires the U-Boot recovery process, which carries a risk of bricking the device. PoC Code Key Timeline 2026-08-03: Reported to the vendor, proposing a 90-day coordinated disclosure period. 2026-08-04: Vendor acknowledged the report and initiated an internal investigation. 2026-08-05: Vendor confirmed that is affected and independently reproduced the PoC. 2026-08-11: Applied for a CVE ID from MITRE; the advisory and PoC were published. Notes The vendor stated that these models are discontinued and no longer maintained; is not included in the current product roadmap. The list of affected devices may be incomplete. The binary also exists in other Wavlink devices, but does not listen on the port by default and is only vulnerable when the service is explicitly enabled.

Goal Reached Thanks to every supporter — we hit 100%!

Wavlink WNS35M1 sync_server Unauthenticated RCE Vulnerability Analysis & PoC

More from this source