Paper/Archive/CVE-2026-74233

CVE-2026-74233

Zbtlink WE1326 — Zbtlink MQWrt infosrvd Command Injection

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 88.8.888 × 2017.8 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.

Affected

ProductAffectedFixed inSource

WE132619.1101–CNA

WE2426-C19.1112–CNA

WE35719.1101–CNA

WE592619.1101–CNA

WE5926-EC_QP20.0516–CNA

WE5926-WD19.1101–CNA

WE826-Q19.1101–CNA

WE826-T219.1101–CNA

WE826-WD19.1101–CNA

WF3526-P19.051–CNA

WG10819.1101–CNA

WG352619.1101–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitvulncheck.com/blog/zbt-darklantern-speakingstone writeupvulncheck.com/advisories/zbtlink-mqwrt-infosrvd-command-injection