CVE-2026-74233 Zbtlink MQWrt infosrvd Command Injection
Remote unauthenticated attackers can execute arbitrary commands as root on Zbtlink routers via a command injection in the infosrvd service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74233?
CVE-2026-74233 is a critical command injection vulnerability in Unknown CTN720-W1, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.
Which versions are affected by CVE-2026-74233?
How do I fix CVE-2026-74233?
No fix has been published for CVE-2026-74233 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-74233 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-74233 exists.
Sources
Also known as GHSA-2h7p-q23r-5gcf.