CVE-2026-74232

A range of Zbtlink (ZBT) and MoreQuick routers ship from the factory with an embedded backdoor implant called yunmgrd that opens an unauthenticated, cleartext UDP command-and-control channel to a hardcoded remote server. Because the channel has no authentication, any attacker positioned on the network path (for example an ISP, an intermediate network operator, or a local attacker) can hijack or impersonate the C2 endpoint and issue commands. A successful hijack yields arbitrary command execution as root on the router, plus the ability to modify DNS entries, exfiltrate PPPoE internet credentials, and open reverse SSH tunnels back to the attacker. Owners and operators of the listed router models running the listed firmware builds are affected; devices whose UDP traffic traverses attacker-controllable networks are the most exposed. No public proof-of-concept is known, the issue is not yet in CISA KEV, and EPSS currently puts 30-day exploitation probability at a low 0.5%, with no confirmed exploitation reported.

What to do: Check inventory for the listed models, verify running firmware against the affected builds, and obtain patched firmware from Zbtlink/MoreQuick or the seller (no fixed versions are specified in available data). Until patched, block or monitor the implant's outbound UDP traffic to its hardcoded C2 server (e.g., via egress filtering), watch for unexpected outbound UDP flows and reverse SSH tunnels from these devices, and rotate PPPoE credentials if compromise is suspected.