CVE-2026-74233Critical· 9.8▾ Midnight

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, an…

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score55/ 100 · Moderate

impact 53.9 · likelihood 0.7 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 27, 2026

Updated

Sep 24, 2026

CVSS

9.8

Vendor

—

Product

—

CWE

CWE-78, CWE-321

Depth score

55 · Moderate

EPSS

3.4% · p89

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Sep 24.

3.4% → 3.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 28 days

Aug 27, 2026Published
Disclosed via NVD
Sep 24, 2026Record revised
Last analysed / modified upstream
Sep 24, 2026EPSS first tracked
3.4%

CWE-78 CWE-321 #nvd

Full technical detail▾

Overview

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed