EUVD-2026-66999
GHSA-jgcj-chrm-4hhc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable backdoor giving root command execution (PR:N/UI:N, AC:L) with full C/I/A impact; scope unchanged as impact stays within the device OS.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.
AnalysisAI
Root-level remote code execution affects a family of Zbtlink, MoreQuick, and related OEM routers/APs (e.g. L3_V2_8 3.0.0.4.528, WE826-T2 19.1101, ZBT-7628, ZBT-ZBT7621, AP522, AP7628, HC5661A, HK300, MAP-N10) that ship a factory backdoor implant named 'yunmgrd' beaconing to a hardcoded cloud C2 over unauthenticated cleartext UDP. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The prerequisite is that the device runs the backdoored firmware containing the 'yunmgrd' implant (the specific models/firmware listed), which beacons to a hardcoded C2 over an unauthenticated, unencrypted UDP channel - no authentication, credentials, or user interaction are required (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are strongly aligned toward high real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker positioned on the network path between an affected router and its hardcoded cloud C2 - for example an upstream/ISP-level actor or someone who can spoof or redirect the C2 endpoint - hijacks the unauthenticated cleartext UDP channel and issues commands to the yunmgrd implant. Given AV:N/AC:L/PR:N, no credentials or user interaction are needed; the attacker executes shell commands as root, rewrites DNS to redirect victim traffic, harvests PPPoE credentials, and opens a reverse SSH tunnel for persistent access. … |
| Remediation | No specific fixed firmware version is identified in the provided data, so 'No vendor-released patch identified at time of analysis' applies - do not assume a clean firmware exists without confirming directly with Zbtlink/MoreQuick and the VulnCheck advisory (https://www.vulncheck.com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an asset inventory to identify all network devices using affected Zbtlink/MoreQuick models and isolate them to a dedicated, air-gapped management network segment; review logs and firewall records for unauthorized SSH access or anomalous outbound UDP connections on port 39889 or similar C2 indicators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-506 – Embedded Malicious Code
View allShare
External POC / Exploit Code
Leaving vuln.today