CVE-2026-74233: Zbtlink MQWrt infosrvd Command Injection
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-ECQP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.
Affected Software
Event History
Frequently Asked Questions
Which devices and firmware versions are known to be affected?
Affected firmware includes version 19.1101 on WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, WG3526, CTN720-W1, LF-1541, and MT7620N. Also affected are WE2426-C 19.1112, WE5926-EC_QP 20.0516, WF3526-P 19.051, and WRC1 20.0622.
What access does an attacker need to exploit this issue?
An attacker only needs network reachability to the infosrvd service on UDP port 9992. No authentication, privileges, or user interaction are required, and successful exploitation executes commands as root.
Is the service authentication a meaningful protection?
No. The authentication mechanism uses a hardcoded salt and can be bypassed with an all-zero wildcard MAC address.
What can be done if a firmware update is not immediately available?
Restrict access to UDP port 9992 so that untrusted networks cannot reach the device's infosrvd service. This is especially important for devices exposed to the internet or reachable from untrusted internal network segments.