CVE-2026-74233

Summary

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.

Affected Software

VendorProductVersion RangeStatus
ZbtlinkWE132619.1101affected
ZbtlinkWE2426-C19.1112affected
ZbtlinkWE35719.1101affected
ZbtlinkWE592619.1101affected
ZbtlinkWE5926-EC_QP20.0516affected
ZbtlinkWE5926-WD19.1101affected
ZbtlinkWE826-Q19.1101affected
ZbtlinkWE826-T219.1101affected
ZbtlinkWE826-WD19.1101affected
ZbtlinkWF3526-P19.051affected
ZbtlinkWG10819.1101affected
ZbtlinkWG352619.1101affected
UnknownCTN720-W119.1101affected
UnknownLF-154119.1101affected
UnknownMT7620N19.1101affected
UnknownWRC120.0622affected

Weaknesses

  • CWE-321: Use of Hard-coded Cryptographic Key
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: total

References