WAVLINK WN535M1 and WN535M3 routers are vulnerable to an unauthenticated OS command injection. A remote attacker can craft a filename containing shell metacharacters and send it to the sync_server daemon on TCP port 13136. The daemon concatenates the attacker‑controlled input into a shell command using sprintf() and then passes the entire string to system() without any sanitization, allowing the attacker to execute arbitrary commands with root privileges. The CWE-78 weakness, combined with a CVSS score of 9.3, indicates a severe impact on confidentiality, integrity, and availability of the affected devices.

Routers manufactured by WAVLINK Technology, specifically the WN535M1 and WN535M3 models, running firmware versions prior to M35M1_V250922 are affected.

The vulnerability is exploitable remotely without authentication by connecting to the sync_server service on port 13136. Because the flaw allows full root execution, the risk is high. The CVSS score of 9.3 reflects the severity, while the EPSS score is not available and the vulnerability is not currently listed in CISA's KEV catalog. Based on the description, the likely attack process is that an attacker sends a specially crafted filename to trigger the injection, immediately gaining privileged control over the router.