CVE-2026-74233
Received Received - Intake

Unauthenticated Command Injection in Zbtlink Firmware

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-74233
EUVD
EUVD-2026-67000

Affected Vendors & Products

Showing 19 associated CPEs
Vendor Product Version / Range
zbtlink we357 19.1101
zbtlink wg108 19.1101
zbtlink wg3526 19.1101
zbtlink ctn720_w1 *
zbtlink lf_1541 *
zbtlink mt7620n 19.1101
zbtlink wrc1 20.0622
zbtlink we1326 19.1101
zbtlink we357 *
zbtlink we5926 19.1101
zbtlink we5926_wd 19.1101
zbtlink we826_q 19.1101
zbtlink we826_t2 19.1101
zbtlink we826_wd 19.1101
zbtlink wg108 *
zbtlink wg3526 *
zbtlink we2426_c 19.1112
zbtlink we5926_ec_qp 20.0516
zbtlink wf3526_p 19.051

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74233 is a critical command injection vulnerability in the infosrvd service of multiple Zbtlink devices. The service listens on UDP port 9992 and lacks proper authentication due to a hardcoded salt and an all-zero wildcard MAC bypass. A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root.

Detection Guidance

To detect this vulnerability, scan your network for devices running the affected Zbtlink firmware versions listening on UDP port 9992. Use commands like 'nmap -sU -p 9992 <target_IP>' to check for open UDP port 9992. If the infosrvd service is running, it may be vulnerable.

Impact Analysis

An attacker could gain full control over affected devices, allowing them to execute malicious commands, install malware, steal data, or disrupt network operations. Since the vulnerability is remotely exploitable without authentication, any device exposed to the internet is at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected devices may face compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update affected devices to patched firmware versions. If updates are unavailable, block UDP traffic to port 9992 at the network perimeter. Disable the infosrvd service if not required. Monitor for unusual command execution or network activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74233. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart