CVE-2026-74233
CriticalCVSS 9.8Summary
Multiple Zbtlink and other devices (including WE1326, WE357, WE5926, WE826-Q, WG108, WG3526, CTN720-W1, LF-1541, MT7620N, WRC1) with specific firmware versions contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.
Risk Assessment
An attacker can gain full control of the device by executing commands as root, potentially leading to network integrity and confidentiality breaches.
Recommendation
Update device firmware to the latest versions if available, and restrict access to UDP port 9992 from trusted networks.
Original NVD description (English source)
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.