Vulnerability-Lookup

CVE-2026-74232 (GCVE-0-2026-74232)

Vulnerability from cvelistv5 – Published: 2026-08-27 10:39 – Updated: 2026-08-27 14:49

Title

Zbtlink MQWrt yunmgrd Cloud C2 Implant

Summary

Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-27 14:48 UTC

CWE

CWE-506 - Embedded Malicious Code
CWE-300 - Channel Accessible by Non-Endpoint

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
http://vulncheck.com/blog/zbt-darklantern-speakingstone	technical-descriptionexploit
https://www.vulncheck.com/advisories/zbtlink-mqwr…	third-party-advisory

Impacted products

15 products

Vendor	Product	Version	CPE status
Zbtlink	L3_V2_8	Affected: 3.0.0.4.528 (custom)	guessed
Zbtlink	WE826-T2	Affected: 19.1101 (custom)	guessed
Zbtlink	ZBT-7628	Affected: 1.0.0.2.007 (custom)	guessed
Zbtlink	ZBT-ZBT7621	Affected: 1.0.0.3.001 (custom)	guessed
MoreQuick	MQAC-7620	Affected: 1.0.0.2.000 (custom)	guessed
MoreQuick	MQAC-7620A	Affected: 1.0.0.2.000 (custom)	guessed
MoreQuick	MQAP-7620	Affected: 1.0.0.2.000 (custom)	guessed
MoreQuick	MQAP-7620A	Affected: 1.0.0.2.000 (custom)	guessed
MoreQuick	MQAP-7628	Affected: 1.0.0.2.000 (custom)	guessed
Unknown	AP522	Affected: 1.0.0.2.014 (custom)	guessed
Unknown	AP7628	Affected: 3.0.0.4.380 (custom)	guessed
Unknown	APG721B	Affected: 19.0809 (custom)	guessed
Unknown	HC5661A	Affected: 3.0.0.4.380 (custom)	guessed
Unknown	HK300	Affected: 1.0.0.2.032 (custom)	guessed
Unknown	MAP-N10	Affected: 1.0.0.2.044 (custom)	guessed

Date Public

2026-08-27 00:00

Credits

Jacob Baines of VulnCheck

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74232",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-27T14:48:59.362199Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T14:49:10.575Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "L3_V2_8",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0.4.528",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "WE826-T2",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "19.1101",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "ZBT-7628",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.007",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "ZBT-ZBT7621",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.3.001",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "MQAC-7620",
          "vendor": "MoreQuick",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.000",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "MQAC-7620A",
          "vendor": "MoreQuick",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.000",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "MQAP-7620",
          "vendor": "MoreQuick",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.000",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "MQAP-7620A",
          "vendor": "MoreQuick",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.000",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "MQAP-7628",
          "vendor": "MoreQuick",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.000",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "AP522",
          "vendor": "Unknown",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.014",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "AP7628",
          "vendor": "Unknown",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0.4.380",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "APG721B",
          "vendor": "Unknown",
          "versions": [
            {
              "status": "affected",
              "version": "19.0809",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "HC5661A",
          "vendor": "Unknown",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0.4.380",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "HK300",
          "vendor": "Unknown",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.032",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "MAP-N10",
          "vendor": "Unknown",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.044",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jacob Baines of VulnCheck"
        }
      ],
      "datePublic": "2026-08-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-94",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-94 Adversary in the Middle (AiTM)"
            }
          ]
        },
        {
          "capecId": "CAPEC-142",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-142 DNS Cache Poisoning"
            }
          ]
        },
        {
          "capecId": "CAPEC-248",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-248 Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-506",
              "description": "Embedded Malicious Code",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-300",
              "description": "Channel Accessible by Non-Endpoint",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T10:39:14.386Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "VulnCheck Blog",
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "http://vulncheck.com/blog/zbt-darklantern-speakingstone"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Zbtlink MQWrt yunmgrd Cloud C2 Implant",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-74232",
    "datePublished": "2026-08-27T10:39:14.386Z",
    "dateReserved": "2026-08-14T18:01:19.917Z",
    "dateUpdated": "2026-08-27T14:49:10.575Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74232\",\"sourceIdentifier\":\"disclosure@vulncheck.com\",\"published\":\"2026-08-27T13:18:33.917\",\"lastModified\":\"2026-08-27T17:19:51.953\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.\"}],\"affected\":[{\"source\":\"disclosure@vulncheck.com\",\"affectedData\":[{\"vendor\":\"Zbtlink\",\"product\":\"L3_V2_8\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"3.0.0.4.528\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WE826-T2\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"19.1101\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"ZBT-7628\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"1.0.0.2.007\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"ZBT-ZBT7621\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"1.0.0.3.001\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"MoreQuick\",\"product\":\"MQAC-7620\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"1.0.0.2.000\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"MoreQuick\",\"product\":\"MQAC-7620A\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"1.0.0.2.000\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"MoreQuick\",\"product\":\"MQAP-7620\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"1.0.0.2.000\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"MoreQuick\",\"product\":\"MQAP-7620A\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"1.0.0.2.000\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"MoreQuick\",\"product\":\"MQAP-7628\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"1.0.0.2.000\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Unknown\",\"product\":\"AP522\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"1.0.0.2.014\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Unknown\",\"product\":\"AP7628\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"3.0.0.4.380\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Unknown\",\"product\":\"APG721B\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"19.0809\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Unknown\",\"product\":\"HC5661A\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"3.0.0.4.380\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Unknown\",\"product\":\"HK300\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"1.0.0.2.032\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Unknown\",\"product\":\"MAP-N10\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"1.0.0.2.044\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-27T14:48:59.362199Z\",\"id\":\"CVE-2026-74232\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-300\"},{\"lang\":\"en\",\"value\":\"CWE-506\"}]}],\"references\":[{\"url\":\"http://vulncheck.com/blog/zbt-darklantern-speakingstone\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://www.vulncheck.com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant\",\"source\":\"disclosure@vulncheck.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-74232\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-27T14:48:59.362199Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-27T14:49:06.539Z\"}}], \"cna\": {\"title\": \"Zbtlink MQWrt yunmgrd Cloud C2 Implant\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Jacob Baines of VulnCheck\"}], \"impacts\": [{\"capecId\": \"CAPEC-94\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-94 Adversary in the Middle (AiTM)\"}]}, {\"capecId\": \"CAPEC-142\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-142 DNS Cache Poisoning\"}]}, {\"capecId\": \"CAPEC-248\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-248 Command Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 9.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Zbtlink\", \"product\": \"L3_V2_8\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0.0.4.528\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Zbtlink\", \"product\": \"WE826-T2\", \"versions\": [{\"status\": \"affected\", \"version\": \"19.1101\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Zbtlink\", \"product\": \"ZBT-7628\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0.2.007\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Zbtlink\", \"product\": \"ZBT-ZBT7621\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0.3.001\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"MoreQuick\", \"product\": \"MQAC-7620\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0.2.000\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"MoreQuick\", \"product\": \"MQAC-7620A\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0.2.000\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"MoreQuick\", \"product\": \"MQAP-7620\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0.2.000\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"MoreQuick\", \"product\": \"MQAP-7620A\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0.2.000\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"MoreQuick\", \"product\": \"MQAP-7628\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0.2.000\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Unknown\", \"product\": \"AP522\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0.2.014\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Unknown\", \"product\": \"AP7628\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0.0.4.380\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Unknown\", \"product\": \"APG721B\", \"versions\": [{\"status\": \"affected\", \"version\": \"19.0809\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Unknown\", \"product\": \"HC5661A\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0.0.4.380\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Unknown\", \"product\": \"HK300\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0.2.032\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Unknown\", \"product\": \"MAP-N10\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0.2.044\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2026-08-27T00:00:00.000Z\", \"references\": [{\"url\": \"http://vulncheck.com/blog/zbt-darklantern-speakingstone\", \"name\": \"VulnCheck Blog\", \"tags\": [\"technical-description\", \"exploit\"]}, {\"url\": \"https://www.vulncheck.com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.4\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-506\", \"description\": \"Embedded Malicious Code\"}, {\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-300\", \"description\": \"Channel Accessible by Non-Endpoint\"}]}], \"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2026-08-27T10:39:14.386Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-74232\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-27T14:49:10.575Z\", \"dateReserved\": \"2026-08-14T18:01:19.917Z\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"datePublished\": \"2026-08-27T10:39:14.386Z\", \"assignerShortName\": \"VulnCheck\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-74232

Vulnerability from fkie_nvd - Published: 2026-08-27 13:18 - Updated: 2026-08-27 17:19

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	disclosure@vulncheck.com	http://vulncheck.com/blog/zbt-darklantern-speakingstone
	disclosure@vulncheck.com	https://www.vulncheck.com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "L3_V2_8",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0.4.528",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "WE826-T2",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "19.1101",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "ZBT-7628",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.007",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "ZBT-ZBT7621",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.3.001",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "MQAC-7620",
          "vendor": "MoreQuick",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.000",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "MQAC-7620A",
          "vendor": "MoreQuick",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.000",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "MQAP-7620",
          "vendor": "MoreQuick",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.000",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "MQAP-7620A",
          "vendor": "MoreQuick",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.000",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "MQAP-7628",
          "vendor": "MoreQuick",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.000",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "AP522",
          "vendor": "Unknown",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.014",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "AP7628",
          "vendor": "Unknown",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0.4.380",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "APG721B",
          "vendor": "Unknown",
          "versions": [
            {
              "status": "affected",
              "version": "19.0809",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "HC5661A",
          "vendor": "Unknown",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0.4.380",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "HK300",
          "vendor": "Unknown",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.032",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "MAP-N10",
          "vendor": "Unknown",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2.044",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels."
    }
  ],
  "id": "CVE-2026-74232",
  "lastModified": "2026-08-27T17:19:51.953",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-74232",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-27T14:48:59.362199Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-27T13:18:33.917",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "url": "http://vulncheck.com/blog/zbt-darklantern-speakingstone"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://www.vulncheck.com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-300"
        },
        {
          "lang": "en",
          "value": "CWE-506"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}

GHSA-JGCJ-CHRM-4HHC

Vulnerability from github – Published: 2026-08-27 15:31 – Updated: 2026-08-27 15:31

Details

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74232"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-300"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-27T13:18:33Z",
    "severity": "CRITICAL"
  },
  "details": "Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.",
  "id": "GHSA-jgcj-chrm-4hhc",
  "modified": "2026-08-27T15:31:34Z",
  "published": "2026-08-27T15:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74232"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant"
    },
    {
      "type": "WEB",
      "url": "http://vulncheck.com/blog/zbt-darklantern-speakingstone"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-74232 (GCVE-0-2026-74232)

FKIE_CVE-2026-74232

GHSA-JGCJ-CHRM-4HHC

Tags

Sightings

Nomenclature