Zbtlink Routers CVE-2026-74233

Exploitation requires network reachability to the infosrvd service on UDP port 9992 on an affected Zbtlink device running the listed firmware; the attacker abuses the service's hardcoded salt and all-zero wildcard MAC authentication bypass, so no valid credentials, user interaction, or non-default configuration are needed (AV:N/AC:L/AT:N/PR:N/UI:N). The primary limiting factor is that UDP/9992 must be reachable from the attacker: on deployments where the management service is firewalled to the LAN or a management VLAN, remote exploitation from the internet is blocked, reducing exposure to internal or on-path attackers. Exploitation is otherwise unrestricted against default configurations of the affected models.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) indicates fully remote, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact, and the description corroborates every metric: a single UDP packet, no auth, root-level command execution. Publicly available exploit code (VulnCheck) materially raises real-world risk by lowering the barrier to weaponization. However, exploitation requires reachability of UDP/9992, which on properly deployed edge routers should be WAN-firewalled, so internet-wide mass exploitation depends on how many units expose the management service externally. EPSS is not provided in the input, and the vulnerability is not listed in CISA KEV at time of analysis, so there is no confirmation of active exploitation - POC availability and active exploitation are distinct signals. The main remaining uncertainty is patch availability: no fix version was provided, which weakens remediation confidence.

An attacker scans for internet-reachable Zbtlink routers exposing UDP/9992, then sends a single crafted infosrvd packet using the all-zero wildcard MAC and hardcoded-salt-derived value to pass authentication. The packet carries an injected shell command that infosrvd executes as root, giving the attacker immediate full control of the device - enabling traffic interception, pivoting into the internal network, or enrollment into a botnet. Public exploit code from VulnCheck makes this achievable with minimal effort and no user interaction.