Read the docs
TI-2026-52021 Aliases CVE-2026-74233GHSA-2h7p-q23r-5gcf

Zbtlink MQWrt infosrvd Command Injection

Priority HIGH 81CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321 and CWE-78.

Summary

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0337 88th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZbtlinkWE132619.1101—No fix listedCNA
ZbtlinkWE2426-C19.1112—No fix listedCNA
ZbtlinkWE35719.1101—No fix listedCNA
ZbtlinkWE592619.1101—No fix listedCNA
ZbtlinkWE5926-EC_QP20.0516—No fix listedCNA
ZbtlinkWE5926-WD19.1101—No fix listedCNA
ZbtlinkWE826-Q19.1101—No fix listedCNA
ZbtlinkWE826-T219.1101—No fix listedCNA
ZbtlinkWE826-WD19.1101—No fix listedCNA
ZbtlinkWF3526-P19.051—No fix listedCNA
ZbtlinkWG10819.1101—No fix listedCNA
ZbtlinkWG352619.1101—No fix listedCNA
UnknownCTN720-W119.1101—No fix listedCNA
UnknownLF-154119.1101—No fix listedCNA
UnknownMT7620N19.1101—No fix listedCNA
UnknownWRC120.0622—No fix listedCNA
  • WE1326 VendorZbtlink Affected 19.1101 Fixed in — No fix listed CNA
  • WE2426-C VendorZbtlink Affected 19.1112 Fixed in — No fix listed CNA
  • WE357 VendorZbtlink Affected 19.1101 Fixed in — No fix listed CNA
  • WE5926 VendorZbtlink Affected 19.1101 Fixed in — No fix listed CNA
  • WE5926-EC_QP VendorZbtlink Affected 20.0516 Fixed in — No fix listed CNA
  • WE5926-WD VendorZbtlink Affected 19.1101 Fixed in — No fix listed CNA
  • WE826-Q VendorZbtlink Affected 19.1101 Fixed in — No fix listed CNA
  • WE826-T2 VendorZbtlink Affected 19.1101 Fixed in — No fix listed CNA
  • WE826-WD VendorZbtlink Affected 19.1101 Fixed in — No fix listed CNA
  • WF3526-P VendorZbtlink Affected 19.051 Fixed in — No fix listed CNA
  • WG108 VendorZbtlink Affected 19.1101 Fixed in — No fix listed CNA
  • WG3526 VendorZbtlink Affected 19.1101 Fixed in — No fix listed CNA
  • CTN720-W1 VendorUnknown Affected 19.1101 Fixed in — No fix listed CNA
  • LF-1541 VendorUnknown Affected 19.1101 Fixed in — No fix listed CNA
  • MT7620N VendorUnknown Affected 19.1101 Fixed in — No fix listed CNA
  • WRC1 VendorUnknown Affected 20.0622 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-74233
  2. 2026-10-03 Alias added: GHSA-2h7p-q23r-5gcf

References

—

  • TI-2026-52020 Zbtlink MQWrt yunmgrd Cloud C2 Implant CVSS 4.0CRITICAL 9.3
  • TI-2026-47395 ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences