Threats tagged 'ghsa-pg3c-cqw3-4pgg'

WAVLINK WN535M1 and WN535M3 routers with firmware versions prior to M35M1_V250922 have an unauthenticated arbitrary file write vulnerability. This flaw allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136, which runs as root and requires no authentication. The vulnerability arises because the daemon accepts a filename field without path canonicalization, enabling absolute path specification and arbitrary file overwrite, potentially leading to persistent system compromise.