The vulnerability CVE-2026-89010 affects WAVLINK WN535M1 and WN535M3 routers running firmware before M35M1_V250922. The sync_server daemon listens on TCP port 13136 and processes filenames sent by remote users. It constructs shell commands using sprintf() with these filenames, which may contain shell metacharacters. Because the input is not sanitized before being passed to system(), an attacker can inject arbitrary OS commands that execute with root privileges on the device.

Successful exploitation results in unauthenticated remote code execution as root on affected devices. This grants attackers full control over the router, potentially compromising network security, intercepting traffic, or deploying persistent malware. The CVSS 4.0 score of 9.3 reflects the critical severity due to network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

A firmware update to version M35M1_V250922 or later addresses this vulnerability. Users should upgrade their devices to this fixed firmware version as soon as possible. No other mitigations are indicated. Patch status is not explicitly confirmed in the input, but the fixed version is stated, so updating to M35M1_V250922 or later is the recommended remediation.