Skip to main content

Zbtlink Routers EUVDEUVD-2026-67000

| CVE-2026-74233 CRITICAL
Use of Hard-coded Cryptographic Key (CWE-321)
2026-08-27 VulnCheck GHSA-2h7p-q23r-5gcf
Command Injection We1326 We2426 C We357 We5926 We5926 Ec Qp We5926 Wd We826 Q We826 T2 We826 Wd Wf3526 P Wg108 Wg3526 Ctn720 W1 Lf 1541 Mt7620N Wrc1
9.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.8 CRITICAL

Single unauthenticated UDP packet yields root command execution remotely, so AV:N/AC:L/PR:N/UI:N with full C/I/A; scope unchanged as impact stays on the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 27, 2026 - 13:33 vuln.today
CVE Published
Aug 27, 2026 - 10:40 cve.org
CRITICAL 9.3

DescriptionCVE.org

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.

AnalysisAI

Remote unauthenticated command execution affects a broad range of Zbtlink MT7620-based routers and gateways (WE1326, WE2426-C, WE5926 family, WE826 family, WG108/WG3526, WF3526-P, CTN720-W1, LF-1541, MT7620N, WRC1) whose infosrvd service listens on UDP/9992. A single crafted UDP packet lets an attacker run arbitrary commands as root, because the service's authentication relies on a hardcoded salt and accepts an all-zero wildcard MAC, defeating the intended check. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Scan for exposed UDP/9992 infosrvd
Delivery
Send crafted packet with all-zero MAC
Exploit
Bypass hardcoded-salt authentication
Execution
Inject shell command
Persist
Execute arbitrary commands as root
Impact
Pivot or enlist device into botnet
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network reachability to the infosrvd service on UDP port 9992 on an affected Zbtlink device running the listed firmware; the attacker abuses the service's hardcoded salt and all-zero wildcard MAC authentication bypass, so no valid credentials, user interaction, or non-default configuration are needed (AV:N/AC:L/AT:N/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine high-priority issue rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker scans for internet-reachable Zbtlink routers exposing UDP/9992, then sends a single crafted infosrvd packet using the all-zero wildcard MAC and hardcoded-salt-derived value to pass authentication. The packet carries an injected shell command that infosrvd executes as root, giving the attacker immediate full control of the device - enabling traffic interception, pivoting into the internal network, or enrollment into a botnet. …
Remediation No vendor-released patch or fixed firmware version was identified in the provided data at time of analysis, so remediation should center on compensating controls until Zbtlink publishes updated firmware - monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/zbtlink-mqwrt-infosrvd-command-injection) and Zbtlink support channels for a fixed build. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct a network asset scan to identify all Zbtlink MT7620-based routers and gateways by model number across your infrastructure and document their network locations and criticality. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-321 – Use of Hard-coded Cryptographic Key

View all
CVE-2016-4437 CRITICAL POC
9.8
CVE-2025-30406 CRITICAL POC
9.0
CVE-2023-32077 HIGH POC
7.5
CVE-2025-13316 HIGH POC
8.2
CVE-2020-10884 HIGH POC
8.8
CVE-2025-57174 CRITICAL POC
9.8
CVE-2022-0664 CRITICAL POC
9.8
CVE-2025-59407 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

EUVD-2026-67000 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy