WAVLINK WN535M1 and WN535M3 routers run a sync_server service that listens on TCP port 13136 without any authentication. The service accepts a 100-byte filename field in its protocol header but does not perform path canonicalization. By sending a specially crafted payload, an attacker can specify an absolute path such as \/etc\/passwd or a startup script and overwrite its contents. This arbitrary file write can be used to replace executables, modify configuration files, or overwrite credential stores, enabling persistent compromise of the device and potential escalation to full remote code execution. The vulnerability is classified as CWE-36 (Absolute Path Traversal).

The affected devices are WAVLINK Technology WN535M1 and WN535M3 routers running firmware versions prior to M35M1_V250922. Any router using firmware that has not been updated to M35M1_V250922 or later is susceptible to exploitation.

The flaw carries a CVSS score of 8.8, indicating high severity. The EPSS score is not available, so the current exploitation probability is unknown, but the vulnerability is not listed in the CISA KEV catalog. The daemon runs as root and requires no authentication, so an attacker who can reach the router over the network can directly send the malicious payload and overwrite critical files. The lack of authentication and the absolute path payload enable unlimited file write privileges, making the risk high even though exploit evidence is not publicly cataloged.