WAVLINK WN535M1 and WN535M3 routers are vulnerable to an unauthenticated OS command injection. A remote attacker can craft a filename containing shell metacharacters and send it to the sync_server daemon on TCP port 13136. The daemon concatenates the attacker‑controlled input into a shell command using sprintf() and then passes the entire string to system() without any sanitization, allowing the attacker to execute arbitrary commands with root privileges. The CWE‑78 weakness, combined with a CVSS score of 9.3, indicates a severe impact on confidentiality, integrity, and availability of the affected devices.

Routers manufactured by WAVLINK Technology, specifically the WN535M1 and WN535M3 models, running firmware versions prior to M35M1_V250922 are affected.

The vulnerability is exploitable remotely without authentication by connecting to the sync_server service on port 13136. Because the flaw allows full root execution, the risk is high. The CVSS score of 9.3 reflects the severity, while the EPSS score is 3% and the vulnerability is not currently listed in CISA's KEV catalog. Based on the description, the likely attack process is that an attacker sends a specially crafted filename to trigger the injection, immediately gaining privileged control over the router.