Wavlink Technology - Wn535m1 - CRITICAL - CVE-2026-89010. WAVLINK WN535M1 and WN535M3 routers with firmware versions earlier than M35M1_V250922 are susceptible to an OS command injection vulnerability. This flaw allows attackers, without authentication, to execute arbitrary commands with root privileges by sending maliciously crafted filenames to the sync_server daemon listening on TCP port 13136. The sync_server improperly handles input that includes shell metacharacters, utilizing the unsafe sprintf() function to construct shell command strings before passing them to system(). This oversight opens a significant security breach, allowing remote exploitation of the affected devices. BADGES: 👾 EXPLOITED | 🟡 PoC | SecurityVulnerability.io