CVE-2026-74233

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Aug 27, 2026
Source updated: Aug 27, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Zbtlink MQWrt infosrvd Command Injection

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

WE1326

Vendor: Zbtlink
Product: WE1326
Platforms: Unknown
Default status: unknown

WE1326 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
19.1101	`affected`	custom	Unavailable	Unavailable	None listed

WE2426-C

Vendor: Zbtlink
Product: WE2426-C
Platforms: Unknown
Default status: unknown

WE2426-C · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
19.1112	`affected`	custom	Unavailable	Unavailable	None listed

WE357

Vendor: Zbtlink
Product: WE357
Platforms: Unknown
Default status: unknown

WE357 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
19.1101	`affected`	custom	Unavailable	Unavailable	None listed

WE5926

Vendor: Zbtlink
Product: WE5926
Platforms: Unknown
Default status: unknown

WE5926 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
19.1101	`affected`	custom	Unavailable	Unavailable	None listed

WE5926-EC_QP

Vendor: Zbtlink
Product: WE5926-EC_QP
Platforms: Unknown
Default status: unknown

WE5926-EC_QP · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
20.0516	`affected`	custom	Unavailable	Unavailable	None listed

WE5926-WD

Vendor: Zbtlink
Product: WE5926-WD
Platforms: Unknown
Default status: unknown

WE5926-WD · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
19.1101	`affected`	custom	Unavailable	Unavailable	None listed

WE826-Q

Vendor: Zbtlink
Product: WE826-Q
Platforms: Unknown
Default status: unknown

WE826-Q · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
19.1101	`affected`	custom	Unavailable	Unavailable	None listed

WE826-T2

Vendor: Zbtlink
Product: WE826-T2
Platforms: Unknown
Default status: unknown

WE826-T2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
19.1101	`affected`	custom	Unavailable	Unavailable	None listed

WE826-WD

Vendor: Zbtlink
Product: WE826-WD
Platforms: Unknown
Default status: unknown

WE826-WD · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
19.1101	`affected`	custom	Unavailable	Unavailable	None listed

WF3526-P

Vendor: Zbtlink
Product: WF3526-P
Platforms: Unknown
Default status: unknown

WF3526-P · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
19.051	`affected`	custom	Unavailable	Unavailable	None listed

WG108

Vendor: Zbtlink
Product: WG108
Platforms: Unknown
Default status: unknown

WG108 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
19.1101	`affected`	custom	Unavailable	Unavailable	None listed

WG3526

Vendor: Zbtlink
Product: WG3526
Platforms: Unknown
Default status: unknown

WG3526 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
19.1101	`affected`	custom	Unavailable	Unavailable	None listed

CTN720-W1

Vendor: Unknown
Product: CTN720-W1
Platforms: Unknown
Default status: unknown

CTN720-W1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
19.1101	`affected`	custom	Unavailable	Unavailable	None listed

LF-1541

Vendor: Unknown
Product: LF-1541
Platforms: Unknown
Default status: unknown

LF-1541 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
19.1101	`affected`	custom	Unavailable	Unavailable	None listed

MT7620N

Vendor: Unknown
Product: MT7620N
Platforms: Unknown
Default status: unknown

MT7620N · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
19.1101	`affected`	custom	Unavailable	Unavailable	None listed

WRC1

Vendor: Unknown
Product: WRC1
Platforms: Unknown
Default status: unknown

WRC1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
20.0622	`affected`	custom	Unavailable	Unavailable	None listed