Unauthenticated RCE in Zbtlink Router Firmware

Zbtlink router firmware for numerous models, including the WE, WG, and WRC series, contains a critical command injection vulnerability (CVE-2026-74233) within the infosrvd service. This service, which typically listens on UDP port 9992, fails to enforce authentication correctly due to the use of hardcoded salts and a vulnerable wildcard MAC address bypass mechanism. A remote, unauthenticated attacker can exploit this flaw by sending a specifically crafted UDP packet to the target device. Successful exploitation results in the execution of arbitrary commands with root privileges. Given the nature of these devices as network edge equipment, successful exploitation allows attackers to gain full control of the router, potentially facilitating further network lateral movement or traffic interception. Defenders should identify affected Zbtlink hardware within their network perimeter and apply vendor firmware updates or restrict access to the infosrvd service.

Impact

Successful exploitation allows for full administrative control over the affected Zbtlink routers, effectively compromising the integrity and security of the network traffic passing through these devices. This vulnerability affects a wide array of SOHO and industrial router models widely distributed across various sectors. If exploited, an attacker could maintain persistent access, exfiltrate sensitive data, or use the device as a pivot point to conduct further attacks against internal network resources.

Recommendation

• Immediately audit network perimeters to identify Zbtlink devices listed in the affected products section and ensure they are isolated from public-facing internet segments.
• Disable the infosrvd service on affected devices if a firmware update is not yet available, or block UDP port 9992 at the firewall for any traffic originating from untrusted sources.
• Prioritize the application of vendor patches for CVE-2026-74233 across all identified Zbtlink router deployments.