A hardcoded command-and-control implant named yunmgrd ships in at least fifteen router and access point firmware builds, giving any unauthenticated attacker on the network path root command execution over a cleartext UDP channel.
What Is It
Multiple Zbtlink, MoreQuick, and unattributed OEM devices ship with a backdoor command-and-control implant (yunmgrd) that beacons to a hardcoded C2 server over an unauthenticated, cleartext UDP channel. Because the channel is neither authenticated nor encrypted, a remote unauthenticated attacker positioned on the network path can hijack it and execute arbitrary commands as root.
Post-hijack capabilities documented in the advisory include modifying DNS entries, exfiltrating PPPoE credentials, and opening reverse SSH tunnels; a full device takeover plus persistent access into the network behind it.
The issue is tracked as CWE-300 (channel accessible by non-endpoint) and CWE-506 (embedded malicious code). It carries a CVSS 3.1 base score of 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS 4.0 score of 9.3 CRITICAL.
Why It Matters
This is not a memory-safety bug that requires exploit development. It is an implant that ships in the firmware, listening by default. Attack complexity is low, no privileges or user interaction are required, and the impact spans confidentiality, integrity, and availability at maximum severity.
DNS manipulation and PPPoE credential theft turn a compromised edge device into a pivot for traffic interception against everything behind it. Reverse SSH tunnels give the attacker durable inbound access that survives NAT and outbound-only firewall policy.
CVE-2026-74232 is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-08-27, so there is no KEV-confirmed active exploitation and no federal remediation deadline attached to it. Readers can verify current status directly against the catalog (linked in Sources), which is updated continuously.
What's Vulnerable
Zbtlink: L3_V2_8 (3.0.0.4.528), WE826-T2 (19.1101), ZBT-7628 (1.0.0.2.007), ZBT-ZBT7621 (1.0.0.3.001)
MoreQuick (all firmware 1.0.0.2.000): MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, MQAP-7628
Unattributed vendor: AP522 (1.0.0.2.014), AP7628 (3.0.0.4.380), APG721B (19.0809), HC5661A (3.0.0.4.380), HK300 (1.0.0.2.032), MAP-N10 (1.0.0.2.044)
Patch Status
No patched firmware version is identified in the NVD record. Default status for every listed product is unknown, meaning versions outside those enumerated have not been confirmed clean. The CVE was published 2026-08-27 with a vulnerability status of Received, so NVD enrichment and CPE mapping are still pending. Consult the VulnCheck advisory for vendor response and mitigation guidance.
Sources
- NVD, CVE-2026-74232: https://nvd.nist.gov/vuln/detail/CVE-2026-74232
- VulnCheck Advisory; Zbtlink/MQWRT yunmgrd Cloud C2 Implant: https://www.vulncheck.com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant
- VulnCheck Blog; ZBT DarkLantern / SpeakingStone: http://vulncheck.com/blog/zbt-darklantern-speakingstone
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog