Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by Zbtlink
CVE-2026-74233 (GCVE-0-2026-74233)
Vulnerability from nvd – Published: 2026-08-27 10:40 – Updated: 2026-08-27 13:41
VLAI
EPSS
VEX
Title
Zbtlink MQWrt infosrvd Command Injection
Summary
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:41 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://vulncheck.com/blog/zbt-darklantern-speakingstone | technical-descriptionexploit |
| https://www.vulncheck.com/advisories/zbtlink-mqwr… | third-party-advisory |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zbtlink | WE1326 |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WE2426-C |
Affected:
19.1112
(custom)
|
|
| Zbtlink | WE357 |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WE5926 |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WE5926-EC_QP |
Affected:
20.0516
(custom)
|
|
| Zbtlink | WE5926-WD |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WE826-Q |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WE826-T2 |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WE826-WD |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WF3526-P |
Affected:
19.051
(custom)
|
|
| Zbtlink | WG108 |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WG3526 |
Affected:
19.1101
(custom)
|
|
| Unknown | CTN720-W1 |
Affected:
19.1101
(custom)
|
|
| Unknown | LF-1541 |
Affected:
19.1101
(custom)
|
|
| Unknown | MT7620N |
Affected:
19.1101
(custom)
|
|
| Unknown | WRC1 |
Affected:
20.0622
(custom)
|
Date Public
2026-08-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74233",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:41:26.633961Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:41:32.924Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WE1326",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE2426-C",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1112",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE357",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE5926",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE5926-EC_QP",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "20.0516",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE5926-WD",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE826-Q",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE826-T2",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE826-WD",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WF3526-P",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.051",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG108",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG3526",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "CTN720-W1",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "LF-1541",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MT7620N",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WRC1",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "20.0622",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jacob Baines of VulnCheck"
}
],
"datePublic": "2026-08-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service\u0027s authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T10:40:11.313Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
],
"url": "http://vulncheck.com/blog/zbt-darklantern-speakingstone"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zbtlink-mqwrt-infosrvd-command-injection"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Zbtlink MQWrt infosrvd Command Injection",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-74233",
"datePublished": "2026-08-27T10:40:11.313Z",
"dateReserved": "2026-08-14T18:01:19.917Z",
"dateUpdated": "2026-08-27T13:41:32.924Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74232 (GCVE-0-2026-74232)
Vulnerability from nvd – Published: 2026-08-27 10:39 – Updated: 2026-08-27 14:49
VLAI
EPSS
VEX
Title
Zbtlink MQWrt yunmgrd Cloud C2 Implant
Summary
Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:48 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://vulncheck.com/blog/zbt-darklantern-speakingstone | technical-descriptionexploit |
| https://www.vulncheck.com/advisories/zbtlink-mqwr… | third-party-advisory |
Impacted products
15 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zbtlink | L3_V2_8 |
Affected:
3.0.0.4.528
(custom)
|
|
| Zbtlink | WE826-T2 |
Affected:
19.1101
(custom)
|
|
| Zbtlink | ZBT-7628 |
Affected:
1.0.0.2.007
(custom)
|
|
| Zbtlink | ZBT-ZBT7621 |
Affected:
1.0.0.3.001
(custom)
|
|
| MoreQuick | MQAC-7620 |
Affected:
1.0.0.2.000
(custom)
|
|
| MoreQuick | MQAC-7620A |
Affected:
1.0.0.2.000
(custom)
|
|
| MoreQuick | MQAP-7620 |
Affected:
1.0.0.2.000
(custom)
|
|
| MoreQuick | MQAP-7620A |
Affected:
1.0.0.2.000
(custom)
|
|
| MoreQuick | MQAP-7628 |
Affected:
1.0.0.2.000
(custom)
|
|
| Unknown | AP522 |
Affected:
1.0.0.2.014
(custom)
|
|
| Unknown | AP7628 |
Affected:
3.0.0.4.380
(custom)
|
|
| Unknown | APG721B |
Affected:
19.0809
(custom)
|
|
| Unknown | HC5661A |
Affected:
3.0.0.4.380
(custom)
|
|
| Unknown | HK300 |
Affected:
1.0.0.2.032
(custom)
|
|
| Unknown | MAP-N10 |
Affected:
1.0.0.2.044
(custom)
|
Date Public
2026-08-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74232",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:48:59.362199Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:49:10.575Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "L3_V2_8",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.528",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE826-T2",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "ZBT-7628",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.007",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "ZBT-ZBT7621",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "1.0.0.3.001",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MQAC-7620",
"vendor": "MoreQuick",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.000",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MQAC-7620A",
"vendor": "MoreQuick",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.000",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MQAP-7620",
"vendor": "MoreQuick",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.000",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MQAP-7620A",
"vendor": "MoreQuick",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.000",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MQAP-7628",
"vendor": "MoreQuick",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.000",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "AP522",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.014",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "AP7628",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.380",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "APG721B",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "19.0809",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "HC5661A",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.380",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "HK300",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.032",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MAP-N10",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.044",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jacob Baines of VulnCheck"
}
],
"datePublic": "2026-08-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94 Adversary in the Middle (AiTM)"
}
]
},
{
"capecId": "CAPEC-142",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-142 DNS Cache Poisoning"
}
]
},
{
"capecId": "CAPEC-248",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-248 Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "Embedded Malicious Code",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-300",
"description": "Channel Accessible by Non-Endpoint",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T10:39:14.386Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
],
"url": "http://vulncheck.com/blog/zbt-darklantern-speakingstone"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Zbtlink MQWrt yunmgrd Cloud C2 Implant",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-74232",
"datePublished": "2026-08-27T10:39:14.386Z",
"dateReserved": "2026-08-14T18:01:19.917Z",
"dateUpdated": "2026-08-27T14:49:10.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66747 (GCVE-0-2026-66747)
Vulnerability from nvd – Published: 2026-08-05 10:50 – Updated: 2026-08-05 14:20
VLAI
EPSS
VEX
Title
ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant
Summary
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 14:19 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.vulncheck.com/blog/zbt-endlessdoors | technical-descriptionexploit |
| https://www.zbtlink.com/pages/zbt-router-firmware… | product |
| https://github.com/ycsunjane/rctl | |
| https://www.vulncheck.com/advisories/zbt-endlessdoors | third-party-advisory |
Impacted products
20 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zbtlink | CPE2801 Firmware |
Affected:
22.10.09
(custom)
cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE1026-5G-WD Firmware |
Affected:
21.04.07
(custom)
cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE1326 Firmware |
Affected:
22.02.18_1
(custom)
cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2007 Firmware |
Affected:
23.08.12
(custom)
cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2008-DSIM Firmware |
Affected:
23.08.11
(custom)
cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2416 Firmware |
Affected:
21.03.22_1
(custom)
cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE3326 Firmware |
Affected:
20.09.30
(custom)
cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5927 Firmware |
Affected:
22.08.10
(custom)
cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5931 Firmware |
Affected:
22.05.31
(custom)
cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5931AC Firmware |
Affected:
22.05.31
(custom)
cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE826-T3-DSIM Firmware |
Affected:
21.12.21
(custom)
cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG108 Firmware |
Affected:
21.08.06_1
(custom)
cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG209 Firmware |
Affected:
21.07.28
(custom)
cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG259 Firmware |
Affected:
21.03.23
(custom)
cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG1602 Firmware |
Affected:
23.10.11
(custom)
cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG1608-DSIM Firmware |
Affected:
23.03.16
(custom)
cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG2105 Firmware |
Affected:
22.05.30
(custom)
cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG2107 Firmware |
Affected:
22.09.08
(custom)
cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG3526 Firmware |
Affected:
22.11.01
(custom)
cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | ZBT-Z8102AX-2SIM Firmware |
Affected:
7.6.7.2-25.0814_114432
(custom)
cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:* |
Date Public
2026-08-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66747",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:19:25.533200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:20:12.478Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "CPE2801 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.10.09",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE1026-5G-WD Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.04.07",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE1326 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.02.18_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2007 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.08.12",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2008-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.08.11",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2416 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.03.22_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE3326 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "20.09.30",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5927 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.08.10",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5931 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.31",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5931AC Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.31",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE826-T3-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.12.21",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG108 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.08.06_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG209 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.07.28",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG259 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.03.23",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG1602 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.10.11",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG1608-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.03.16",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG2105 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.30",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG2107 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.09.08",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG3526 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.11.01",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"ARM"
],
"product": "ZBT-Z8102AX-2SIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "7.6.7.2-25.0814_114432",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jacob Baines of VulnCheck"
}
],
"datePublic": "2026-08-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eZbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.\u003c/p\u003e"
}
],
"value": "Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506 Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T10:55:20.206Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "VulnCheck Research Blog",
"tags": [
"technical-description",
"exploit"
],
"url": "https://www.vulncheck.com/blog/zbt-endlessdoors"
},
{
"name": "Vendor Firmware Download Page",
"tags": [
"product"
],
"url": "https://www.zbtlink.com/pages/zbt-router-firmware-download"
},
{
"name": "Upstream Open Source rctl",
"url": "https://github.com/ycsunjane/rctl"
},
{
"name": "VulnCheck Advisory",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zbt-endlessdoors"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-66747",
"datePublished": "2026-08-05T10:50:45.576Z",
"dateReserved": "2026-07-27T16:27:47.648Z",
"dateUpdated": "2026-08-05T14:20:12.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74233 (GCVE-0-2026-74233)
Vulnerability from cvelistv5 – Published: 2026-08-27 10:40 – Updated: 2026-08-27 13:41
VLAI
EPSS
VEX
Title
Zbtlink MQWrt infosrvd Command Injection
Summary
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:41 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://vulncheck.com/blog/zbt-darklantern-speakingstone | technical-descriptionexploit |
| https://www.vulncheck.com/advisories/zbtlink-mqwr… | third-party-advisory |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zbtlink | WE1326 |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WE2426-C |
Affected:
19.1112
(custom)
|
|
| Zbtlink | WE357 |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WE5926 |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WE5926-EC_QP |
Affected:
20.0516
(custom)
|
|
| Zbtlink | WE5926-WD |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WE826-Q |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WE826-T2 |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WE826-WD |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WF3526-P |
Affected:
19.051
(custom)
|
|
| Zbtlink | WG108 |
Affected:
19.1101
(custom)
|
|
| Zbtlink | WG3526 |
Affected:
19.1101
(custom)
|
|
| Unknown | CTN720-W1 |
Affected:
19.1101
(custom)
|
|
| Unknown | LF-1541 |
Affected:
19.1101
(custom)
|
|
| Unknown | MT7620N |
Affected:
19.1101
(custom)
|
|
| Unknown | WRC1 |
Affected:
20.0622
(custom)
|
Date Public
2026-08-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74233",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:41:26.633961Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:41:32.924Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WE1326",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE2426-C",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1112",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE357",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE5926",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE5926-EC_QP",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "20.0516",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE5926-WD",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE826-Q",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE826-T2",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE826-WD",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WF3526-P",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.051",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG108",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG3526",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "CTN720-W1",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "LF-1541",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MT7620N",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WRC1",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "20.0622",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jacob Baines of VulnCheck"
}
],
"datePublic": "2026-08-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service\u0027s authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T10:40:11.313Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
],
"url": "http://vulncheck.com/blog/zbt-darklantern-speakingstone"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zbtlink-mqwrt-infosrvd-command-injection"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Zbtlink MQWrt infosrvd Command Injection",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-74233",
"datePublished": "2026-08-27T10:40:11.313Z",
"dateReserved": "2026-08-14T18:01:19.917Z",
"dateUpdated": "2026-08-27T13:41:32.924Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74232 (GCVE-0-2026-74232)
Vulnerability from cvelistv5 – Published: 2026-08-27 10:39 – Updated: 2026-08-27 14:49
VLAI
EPSS
VEX
Title
Zbtlink MQWrt yunmgrd Cloud C2 Implant
Summary
Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:48 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://vulncheck.com/blog/zbt-darklantern-speakingstone | technical-descriptionexploit |
| https://www.vulncheck.com/advisories/zbtlink-mqwr… | third-party-advisory |
Impacted products
15 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zbtlink | L3_V2_8 |
Affected:
3.0.0.4.528
(custom)
|
|
| Zbtlink | WE826-T2 |
Affected:
19.1101
(custom)
|
|
| Zbtlink | ZBT-7628 |
Affected:
1.0.0.2.007
(custom)
|
|
| Zbtlink | ZBT-ZBT7621 |
Affected:
1.0.0.3.001
(custom)
|
|
| MoreQuick | MQAC-7620 |
Affected:
1.0.0.2.000
(custom)
|
|
| MoreQuick | MQAC-7620A |
Affected:
1.0.0.2.000
(custom)
|
|
| MoreQuick | MQAP-7620 |
Affected:
1.0.0.2.000
(custom)
|
|
| MoreQuick | MQAP-7620A |
Affected:
1.0.0.2.000
(custom)
|
|
| MoreQuick | MQAP-7628 |
Affected:
1.0.0.2.000
(custom)
|
|
| Unknown | AP522 |
Affected:
1.0.0.2.014
(custom)
|
|
| Unknown | AP7628 |
Affected:
3.0.0.4.380
(custom)
|
|
| Unknown | APG721B |
Affected:
19.0809
(custom)
|
|
| Unknown | HC5661A |
Affected:
3.0.0.4.380
(custom)
|
|
| Unknown | HK300 |
Affected:
1.0.0.2.032
(custom)
|
|
| Unknown | MAP-N10 |
Affected:
1.0.0.2.044
(custom)
|
Date Public
2026-08-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74232",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:48:59.362199Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:49:10.575Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "L3_V2_8",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.528",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WE826-T2",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "19.1101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "ZBT-7628",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.007",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "ZBT-ZBT7621",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "1.0.0.3.001",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MQAC-7620",
"vendor": "MoreQuick",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.000",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MQAC-7620A",
"vendor": "MoreQuick",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.000",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MQAP-7620",
"vendor": "MoreQuick",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.000",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MQAP-7620A",
"vendor": "MoreQuick",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.000",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MQAP-7628",
"vendor": "MoreQuick",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.000",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "AP522",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.014",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "AP7628",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.380",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "APG721B",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "19.0809",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "HC5661A",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.380",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "HK300",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.032",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MAP-N10",
"vendor": "Unknown",
"versions": [
{
"status": "affected",
"version": "1.0.0.2.044",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jacob Baines of VulnCheck"
}
],
"datePublic": "2026-08-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94 Adversary in the Middle (AiTM)"
}
]
},
{
"capecId": "CAPEC-142",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-142 DNS Cache Poisoning"
}
]
},
{
"capecId": "CAPEC-248",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-248 Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "Embedded Malicious Code",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-300",
"description": "Channel Accessible by Non-Endpoint",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T10:39:14.386Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
],
"url": "http://vulncheck.com/blog/zbt-darklantern-speakingstone"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Zbtlink MQWrt yunmgrd Cloud C2 Implant",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-74232",
"datePublished": "2026-08-27T10:39:14.386Z",
"dateReserved": "2026-08-14T18:01:19.917Z",
"dateUpdated": "2026-08-27T14:49:10.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66747 (GCVE-0-2026-66747)
Vulnerability from cvelistv5 – Published: 2026-08-05 10:50 – Updated: 2026-08-05 14:20
VLAI
EPSS
VEX
Title
ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant
Summary
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 14:19 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.vulncheck.com/blog/zbt-endlessdoors | technical-descriptionexploit |
| https://www.zbtlink.com/pages/zbt-router-firmware… | product |
| https://github.com/ycsunjane/rctl | |
| https://www.vulncheck.com/advisories/zbt-endlessdoors | third-party-advisory |
Impacted products
20 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zbtlink | CPE2801 Firmware |
Affected:
22.10.09
(custom)
cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE1026-5G-WD Firmware |
Affected:
21.04.07
(custom)
cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE1326 Firmware |
Affected:
22.02.18_1
(custom)
cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2007 Firmware |
Affected:
23.08.12
(custom)
cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2008-DSIM Firmware |
Affected:
23.08.11
(custom)
cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2416 Firmware |
Affected:
21.03.22_1
(custom)
cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE3326 Firmware |
Affected:
20.09.30
(custom)
cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5927 Firmware |
Affected:
22.08.10
(custom)
cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5931 Firmware |
Affected:
22.05.31
(custom)
cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5931AC Firmware |
Affected:
22.05.31
(custom)
cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE826-T3-DSIM Firmware |
Affected:
21.12.21
(custom)
cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG108 Firmware |
Affected:
21.08.06_1
(custom)
cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG209 Firmware |
Affected:
21.07.28
(custom)
cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG259 Firmware |
Affected:
21.03.23
(custom)
cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG1602 Firmware |
Affected:
23.10.11
(custom)
cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG1608-DSIM Firmware |
Affected:
23.03.16
(custom)
cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG2105 Firmware |
Affected:
22.05.30
(custom)
cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG2107 Firmware |
Affected:
22.09.08
(custom)
cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG3526 Firmware |
Affected:
22.11.01
(custom)
cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | ZBT-Z8102AX-2SIM Firmware |
Affected:
7.6.7.2-25.0814_114432
(custom)
cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:* |
Date Public
2026-08-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66747",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:19:25.533200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:20:12.478Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "CPE2801 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.10.09",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE1026-5G-WD Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.04.07",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE1326 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.02.18_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2007 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.08.12",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2008-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.08.11",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2416 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.03.22_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE3326 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "20.09.30",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5927 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.08.10",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5931 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.31",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5931AC Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.31",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE826-T3-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.12.21",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG108 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.08.06_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG209 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.07.28",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG259 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.03.23",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG1602 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.10.11",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG1608-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.03.16",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG2105 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.30",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG2107 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.09.08",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG3526 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.11.01",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"ARM"
],
"product": "ZBT-Z8102AX-2SIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "7.6.7.2-25.0814_114432",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jacob Baines of VulnCheck"
}
],
"datePublic": "2026-08-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eZbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.\u003c/p\u003e"
}
],
"value": "Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506 Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T10:55:20.206Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "VulnCheck Research Blog",
"tags": [
"technical-description",
"exploit"
],
"url": "https://www.vulncheck.com/blog/zbt-endlessdoors"
},
{
"name": "Vendor Firmware Download Page",
"tags": [
"product"
],
"url": "https://www.zbtlink.com/pages/zbt-router-firmware-download"
},
{
"name": "Upstream Open Source rctl",
"url": "https://github.com/ycsunjane/rctl"
},
{
"name": "VulnCheck Advisory",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zbt-endlessdoors"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-66747",
"datePublished": "2026-08-05T10:50:45.576Z",
"dateReserved": "2026-07-27T16:27:47.648Z",
"dateUpdated": "2026-08-05T14:20:12.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}