A critical flaw in the infosrvd service on Zbtlink and related OEM routers lets a remote unauthenticated attacker execute arbitrary commands as root via a single crafted UDP packet.
What Is It
CVE-2026-74233 is an unauthenticated command injection (CWE-78) in the infosrvd service listening on UDP port 9992. A remote attacker with no credentials and no user interaction can send a crafted UDP packet that results in arbitrary command execution as root.
The service does implement an authentication check, but it is ineffective: it relies on a hardcoded salt (CWE-321) and accepts an all-zero wildcard MAC address as a bypass. In practice, the authentication layer offers no protection.
VulnCheck, the CNA for this CVE, assigns a CVSS 3.1 base score of 9.8 (CRITICAL): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS 4.0 score of 9.3 (CRITICAL). These are the CNA-supplied scores carried in the NVD record; NVD has not yet published its own analysis (see Patch Status).
Why It Matters
The vulnerability is network-reachable, requires no privileges and no user interaction, has low attack complexity, and carries full confidentiality, integrity, and availability impact. Successful exploitation yields root on the device, which means full control of the router and the traffic passing through it.
UDP delivery means exploitation requires only a single packet; no session and no handshake, so an attacker can attempt it against many hosts without establishing connections. The hardcoded salt and wildcard MAC bypass mean the fix cannot be worked around by changing a password.
What's Vulnerable
Per the CNA-supplied affected-product data in the CVE record, the following are affected:
- Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, WG3526; firmware 19.1101
- Zbtlink WE2426-C, firmware 19.1112
- Zbtlink WE5926-EC_QP, firmware 20.0516
- Zbtlink WF3526-P, firmware 19.051
- CTN720-W1, LF-1541, MT7620N (vendor unknown), firmware 19.1101
- WRC1 (vendor unknown), firmware 20.0622
Patch Status
As of 2026-08-27, CVE-2026-74233 is not listed in the CISA Known Exploited Vulnerabilities catalog, so there is no KEV-confirmed active exploitation and no KEV-mandated required action. The NVD record is in Received status (published 2026-08-27), meaning it has not yet been enriched by NVD analysts, and it lists no patched versions or vendor fix. Refer to the VulnCheck advisory below for the current disclosure details.
Sources
- NVD, CVE-2026-74233: https://nvd.nist.gov/vuln/detail/CVE-2026-74233
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- VulnCheck Advisory; Zbtlink MQWRT infosrvd Command Injection: https://www.vulncheck.com/advisories/zbtlink-mqwrt-infosrvd-command-injection
- VulnCheck Blog; ZBT DarkLantern / SpeakingStone: http://vulncheck.com/blog/zbt-darklantern-speakingstone