AI analysis
Multiple Zbtlink (ZBT) router models ship with an 'infosrvd' service listening on UDP port 9992 that contains an unauthenticated OS command injection (CWE-78): a single crafted UDP packet from any remote attacker triggers arbitrary command execution with root privileges, and the issue is rated critical at CVSS 4.0 9.3. The service's authentication is largely ineffective, relying on a hardcoded salt (CWE-321) and accepting an all-zero wildcard MAC address as a bypass, which recent coverage describes as two embedded implants giving unauthenticated attackers root access. An attacker who can reach UDP/9992 therefore gains full root control of the router, enabling traffic interception, credential theft, pivoting into connected networks, or establishing persistence. Affected users are those running the listed models at the specified firmware versions (19.1101, 19.1112, 20.0516, 19.051 and 20.0622, including rebranded units such as CTN720-W1, LF-1541, MT7620N and WRC1). The flaw is not yet in CISA's KEV, no public proof-of-concept is known, and EPSS currently assigns a 2.6% probability of exploitation within the next 30 days.
What to do: Block or restrict inbound UDP port 9992 at the network edge and disable the infosrvd service if the firmware allows, since no fixed firmware version is specified in available data; update to the latest vendor firmware when a patch is released. Because the hardcoded-salt authentication and all-zero MAC bypass act as always-on backdoors, treat any internet-exposed unit as potentially compromised, audit it for unauthorized changes, and monitor for Zbtlink advisories about the embedded implants.
Affected
| Zbtlink WE1326 | 19.1101 |
| Zbtlink WE357 | 19.1101 |
| Zbtlink WE5926 | 19.1101 |
| Zbtlink WE5926-WD | 19.1101 |
| Zbtlink WE826-Q | 19.1101 |
| Zbtlink WE826-T2 | 19.1101 |
| Zbtlink WE826-WD | 19.1101 |
| Zbtlink WG108 | 19.1101 |
| Zbtlink WG3526 | 19.1101 |
| Zbtlink WE2426-C | 19.1112 |
| Zbtlink WE5926-EC_QP | 20.0516 |
| Zbtlink WF3526-P | 19.051 |
Estimated exposure
moderate≈10,000-100,000 devices deployed, likely thousands internet-exposed on UDP/9992 (estimate) — No install counts or scan data were provided, so the order of magnitude is inferred from the niche market position of this Chinese SOHO/LTE router brand and its rebranded variants rather than from measured telemetry.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.