WAVLINK Technology vulnerabilities

Products

• WL-WN531AX2 5
• WN535M1 2
• WN535M3 2

Latest WAVLINK Technology CVEs

Newest publication first

1. CVE-2026-89010 WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server

   Published 2026-09-11

   Critical·CVSS 9.3 EPSS 3.2%

   WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync_server daemon on TCP port 13136. T...

2. CVE-2026-89009 WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server

   Published 2026-09-11

   High·CVSS 8.8 EPSS 1.0%

   WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The...

3. CVE-2023-32622 Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS commands with the root privilege.

   Published 2023-06-30

   High·CVSS 7.2 EPSS 0.73%

   Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS commands with the root privilege.

4. CVE-2023-32621 WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege.

   Published 2023-06-30

   High·CVSS 7.2 EPSS 0.68%

   WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege.

5. CVE-2023-32620 Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireless network.

   Published 2023-06-30

   Medium·CVSS 6.5 EPSS 0.30%

   Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireless network.

6. CVE-2023-32613 Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attacker to use functions originally available after login witho...

   Published 2023-06-30

   High·CVSS 8.1 EPSS 0.29%

   Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attacker to use functions originally available after login without logging in.

7. CVE-2023-32612 Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with...

   Published 2023-06-30

   High·CVSS 7.2 EPSS 0.68%

   Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.