External risk intelligence

Shenzhen ZBT WE1626 Router Command Execution via UART

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-45553

The vulnerability requires a physical serial connection to the UART port of the router. This physical access requirement makes the attack surface local-only and not reachable via the public internet or network interfaces.

Code Injection

Zbt We1626 Firmware

21.06.18

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Shenzhen Zhibotong Electronics WBT WE1626 routers, allowing for arbitrary command execution. While this issue could have significant implications, its exploitation requires direct physical access to the device's serial port, limiting its reach primarily to local or internal network environments. The main concern is confirming if this specific technology is deployed within your infrastructure and understanding its exposure.

Allows unauthorized command execution on routers.
Critical flaw impacting network devices.
Confirm relevance and local exposure.

Attack Path

How an attacker could exploit the issue

An attacker could gain control of a vulnerable router by physically connecting to its serial port. Once connected, they can send commands to the router, allowing them to run any command they wish, potentially leading to complete compromise of the device.

Entry: Physical access to the router's serial port.
Trigger: Executing commands via the UART connection.
Risk: Complete device compromise and arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker with physical access to the router's UART port to execute arbitrary commands. This could potentially impact the router's normal operation and any services it provides.

System commands and behavior at risk.
Requires physical access to UART port.
Commands could alter router functions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The identified vulnerability requires physical access to the router's UART port, suggesting that device owners or hardware asset managers are primarily responsible for addressing this issue. The first practical step is to physically inventory all deployed routers, confirm their accessibility, and then plan for remediation by engaging with the vendor or implementing access controls if direct patching is not feasible.

Device owners and hardware asset managers should own the issue.
Verify physical access and device inventory first.
Plan vendor engagement or access control mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Shenzhen ZBT WE1626 router?

The ZBT WE1626 is a hardware router manufactured by Shenzhen Zhibotong Electronics. It is typically used to manage network traffic, provide wireless connectivity, and facilitate internet access for connected devices within a home or small office environment.

What does CVE-2022-45553 mean for the WE1626?

This CVE describes a security weakness classified as CWE-94, or improper control of generation of code. It means the router's software can be tricked into running unauthorized commands, essentially allowing a user to command the device to perform actions it was not intended to do.

How is this vulnerability triggered?

The vulnerability is triggered by establishing a direct physical connection to the router's internal UART serial port. It cannot be triggered by sending packets over the internet or through standard Wi-Fi/Ethernet network traffic, as the command execution path relies entirely on this specific hardware-level interface.

Do I need to worry about this if my router is internal?

According to Halo Surface Signal, this vulnerability is very unlikely to affect most users because it requires physical access to the device. Even if the router is on an internal network, you only need to be concerned if an unauthorized person can physically reach the device to connect cables to its internal circuitry.

How should I respond to this threat?

Your first step is to confirm if your organization uses this specific router model. If you have these devices, ensure they are kept in secure, locked, or monitored physical locations. Since the flaw requires physical access to internal ports, limiting who can physically reach the device hardware is your most effective protection.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.