CVE-2026-74232
Received Received - Intake

Unauthenticated Remote Command Execution in Zbtlink Firmware

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-74232
EUVD
EUVD-2026-66999

Affected Vendors & Products

Showing 21 associated CPEs
Vendor Product Version / Range
zbtlink l3_v2_8 to 3.0.0.4.528 (inc)
zbtlink we826_t2 to 19.1101 (inc)
zbtlink zbt_7628 to 1.0.0.2.007 (inc)
morequick mqac_7620 *
morequick mqac_7620a *
morequick mqap_7620 *
morequick mqap_7620a *
morequick mqap_7628 to 1.0.0.2.000 (inc)
zbtlink ap522 to 1.0.0.2.014 (inc)
zbtlink ap7628 to 3.0.0.4.380 (inc)
zbtlink hkc300 to 1.0.0.2.032 (inc)
zbtlink map_n10 to 1.0.0.2.044 (inc)
zbtlink l3_v2_8 3.0.0.4.528
zbtlink we826_t2 19.1101
zbtlink zbt_7628 1.0.0.2.007
zbtlink zbt_zbt7621 1.0.0.3.001
morequick mqac_7620 1.0.0.2.000
morequick mqac_7620a 1.0.0.2.000
morequick mqap_7620 1.0.0.2.000
morequick mqap_7620a 1.0.0.2.000
morequick mqap_7628 1.0.0.2.000

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-300 The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
CWE-506 The product contains code that appears to be malicious in nature.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74232 involves malicious implants in firmware of routers from Zbtlink and MoreQuick. The yunmgrd backdoor runs on UDP port 9992 with no authentication, allowing remote attackers to execute root commands. It also enables DNS hijacking, credential theft, and reverse SSH tunnels.

Detection Guidance

To detect this vulnerability, check for the presence of the yunmgrd implant listening on UDP port 9992. Use commands like 'netstat -anu | grep 9992' or 'ss -anu | grep 9992' on Linux systems. Additionally, inspect network traffic for connections to hardcoded C2 domains like findmyipaddr.com or ac-link.com using tools like Wireshark or tcpdump.

Impact Analysis

An attacker on your network could take full control of your router, steal sensitive data like PPPoE credentials, redirect your internet traffic via DNS hijacking, or use your device for further attacks like reverse SSH tunnels.

Mitigation Strategies

Immediately isolate affected devices from your network to prevent further exploitation. Update firmware to the latest patched versions if available. Block UDP port 9992 at the network perimeter. Monitor DNS queries for the malicious domains and revoke any unauthorized SSH keys or credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74232. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart