Description

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-27T13:18:34.137Z",
  "pubdate": "2026-08-27T13:18:34.137Z",
  "executiveSummary": "This vulnerability is an unauthenticated remote command injection flaw residing in the infosrvd service of various Zbtlink networking devices, specifically affecting multiple firmware versions. The vulnerability allows an unauthenticated, remote attacker to execute arbitrary system commands with root privileges by transmitting a maliciously crafted UDP packet to port 9992.\nThe core of the issue lies in a broken authentication mechanism, which utilizes a hardcoded salt and a wildcard MAC address bypass, rendering the intended security controls ineffective. As a result, the service fails to validate requests, permitting unauthorized access to the underlying system shell.\nThe risk implication is severe, as successful exploitation grants a remote attacker full control over the affected device. This could lead to complete system compromise, unauthorized data access, persistence installation, or the utilization of the device as a node in a malicious botnet. Because the service is reachable over the network, this vulnerability poses a critical threat to the confidentiality, integrity, and availability of the targeted infrastructure.",
  "technicalDetails": "The vulnerability is situated within the infosrvd service, which operates as a daemon listening on UDP port 9992. This service is designed for device management and discovery but suffers from a critical lack of input sanitization and a fundamentally flawed authentication logic. The service employs an authentication scheme relying on a fixed, hardcoded salt and an all-zero wildcard MAC address check. An attacker can exploit this by providing a specific MAC address value (often identified as an all-zero sequence) that satisfies the logical bypass within the verification function, effectively neutralizing the authentication requirement entirely.\nOnce the flawed authentication gate is bypassed, the service processes incoming UDP packets in an insecure manner. The input provided by the attacker is passed to system-level command execution functions without proper validation or sanitization of shell metacharacters. This enables an attacker to inject arbitrary OS commands that are subsequently executed with root-level privileges by the infosrvd process.\nThe attack flow follows these specific steps: First, the attacker identifies a target device with a publicly accessible UDP port 9992. Second, the attacker crafts a UDP packet containing the necessary authentication bypass payload, which includes the all-zero wildcard MAC address and the desired command payload. Third, the crafted packet is sent to the target's UDP port 9992. Upon reception, the infosrvd service performs its faulty authentication check, which the packet bypasses successfully. Finally, the service passes the injected command string to the system interpreter, executing the payload as root.\nThis vulnerability affects a wide array of Zbtlink hardware, including WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, WG3526 (firmware 19.1101), WE2426-C (firmware 19.1112), WE5926-EC_QP (firmware 20.0516), WF3526-P (firmware 19.051), CTN720-W1, LF-1541, MT7620N (firmware 19.1101), and WRC1 (firmware 20.0622).\nPost-exploitation impact is absolute; because the process runs with root privileges, the attacker gains unrestricted access to the filesystem, network configuration, and system processes. Attackers can leverage this to deploy persistent rootkits, intercept network traffic, or pivot into the internal network protected by the gateway device."
}