External risk intelligence

Zbtlink Firmware Command Injection via UDP/9992

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-74233

The vulnerability resides in a network-exposed service (UDP/9992) within router and gateway firmware. These devices are typically deployed as edge networking equipment, making the service reachable from the public internet by design or common configuration in residential and small-business environments.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Zbtlink router and gateway firmware. An unauthenticated attacker can exploit this flaw to execute arbitrary commands on affected devices with root privileges by sending a specially crafted network packet. The vulnerability is due to an ineffective authentication mechanism within the infosrvd service.

Allows remote code execution without authentication.
Affects network edge devices, potentially exposing many users.
Confirm if affected Zbtlink devices are deployed and exposed.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can send specially crafted UDP packets to a network-exposed service to execute arbitrary commands with root privileges. The service's security mechanisms, including authentication and MAC address validation, are flawed and can be bypassed, allowing for this remote command injection.

Attacker sends crafted UDP packet.
Unauthenticated bypass of service security.
Arbitrary command execution as root.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on affected devices by sending a specially crafted UDP packet to the infosrvd service. These commands would run with root privileges, potentially leading to full system compromise when exposed to the network.

Root command execution on devices.
Unauthenticated network packet injection.
Complete device takeover is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects ZBTlink and other router firmware, impacting network edge devices commonly found in residential and small business environments. Ownership likely falls to infrastructure or platform teams managing network appliances, in coordination with security and vendor management. The immediate first step is to identify all instances of the affected firmware, assess their exposure and criticality, and then plan remediation by engaging the vendor and relevant internal teams.

Infrastructure or Platform teams own remediation.
Verify reachability and business criticality first.
Coordinate with the vendor for a fix.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Zbtlink firmware affected by CVE-2026-74233?

This firmware runs on Zbtlink routers, gateways, and related network hardware including the WE1326, WE826, WG3526, and MT7620N series. These devices are generally used to manage internet connectivity and local network traffic for homes or small businesses, serving as the bridge between your private devices and the wider internet.

How does this command injection vulnerability work?

This issue is categorized as CWE-78 (OS Command Injection) and CWE-321 (Use of Hard-coded Cryptographic Key). It exists because the device's 'infosrvd' service allows an attacker to run system-level commands by sending a specially crafted UDP packet. Because the service relies on a hardcoded salt and an all-zero MAC address bypass for authentication, it fails to verify who is sending the request, effectively treating unauthorized packets as trusted commands with root authority.

Can I trigger this bug by accident?

No. The vulnerability requires a specific, crafted UDP packet sent to port 9992 to activate the injection. It is not triggered by standard web browsing, routine router configuration updates, or normal network traffic. The attack requires intentional targeting of the service with data designed to bypass the authentication mechanisms present in the device's firmware.

Do I need to worry if my device is on a private network?

Halo Surface Signal identifies this service as inherently risky because it is often reachable from the public internet by design. While internal-only devices may have a smaller attack surface, the risk remains if any internet-facing gateway or router uses this firmware. If your device can receive traffic directly from the internet, it is at higher risk than a device isolated behind another firewall.

What should I do first if I run this technology?

Begin by auditing your inventory to identify any routers or gateways running the specific Zbtlink firmware versions listed. Once you have located the devices, determine if they are exposed to the internet. Coordinate with your infrastructure or platform teams to prioritize these assets and contact the vendor for available updates or guidance on securing the service.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.