An attacker positioned on the network path can intercept or hijack these UDP communications to issue unauthorized commands, gaining remote code execution (RCE) with root privileges on the device. Once root access is achieved, attackers can perform full device control, including exfiltration of sensitive PPPoE credentials, hijacking of DNS entries for redirection purposes, and the establishment of persistent reverse SSH tunnels. Given the lack of authentication and the use of cleartext protocols, this vulnerability represents a significant risk for the confidentiality and integrity of network traffic passing through these devices.

Impact

The vulnerability allows full administrative control over the affected routers. Successful exploitation enables attackers to gain persistence, steal sensitive network authentication credentials, perform man-in-the-middle attacks via DNS manipulation, and pivot deeper into the local network through reverse SSH tunnels. This affects multiple residential and small-business router models from Zbtlink and MoreQuick, impacting users across diverse sectors.

Recommendation

• Perform an inventory of all router hardware to identify the specific models and firmware versions listed in the affected products section.
• Isolate any identified vulnerable hardware from internet-facing segments until the vendor provides patched firmware.
• Implement egress filtering at the network perimeter to block unauthorized UDP traffic to unknown destinations if specific C2 infrastructure IPs are identified in future intelligence.
• Monitor network logs for unusual UDP traffic patterns originating from or destined to router management interfaces.