CVE-2026-74232 PUBLISHED

Zbtlink MQWrt yunmgrd Cloud C2 Implant

Assigner: VulnCheck
Reserved: 14.08.2026 Published: 27.08.2026 Updated: 27.08.2026

Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Product Status

Vendor Zbtlink
Product L3_V2_8
Versions Default: unknown
  • Version 3.0.0.4.528 is affected
Vendor Zbtlink
Product WE826-T2
Versions Default: unknown
  • Version 19.1101 is affected
Vendor Zbtlink
Product ZBT-7628
Versions Default: unknown
  • Version 1.0.0.2.007 is affected
Vendor Zbtlink
Product ZBT-ZBT7621
Versions Default: unknown
  • Version 1.0.0.3.001 is affected
Vendor MoreQuick
Product MQAC-7620
Versions Default: unknown
  • Version 1.0.0.2.000 is affected
Vendor MoreQuick
Product MQAC-7620A
Versions Default: unknown
  • Version 1.0.0.2.000 is affected
Vendor MoreQuick
Product MQAP-7620
Versions Default: unknown
  • Version 1.0.0.2.000 is affected
Vendor MoreQuick
Product MQAP-7620A
Versions Default: unknown
  • Version 1.0.0.2.000 is affected
Vendor MoreQuick
Product MQAP-7628
Versions Default: unknown
  • Version 1.0.0.2.000 is affected
Vendor Unknown
Product AP522
Versions Default: unknown
  • Version 1.0.0.2.014 is affected
Vendor Unknown
Product AP7628
Versions Default: unknown
  • Version 3.0.0.4.380 is affected
Vendor Unknown
Product APG721B
Versions Default: unknown
  • Version 19.0809 is affected
Vendor Unknown
Product HC5661A
Versions Default: unknown
  • Version 3.0.0.4.380 is affected
Vendor Unknown
Product HK300
Versions Default: unknown
  • Version 1.0.0.2.032 is affected
Vendor Unknown
Product MAP-N10
Versions Default: unknown
  • Version 1.0.0.2.044 is affected

Credits

  • Jacob Baines of VulnCheck finder

References

Problem Types

  • Embedded Malicious Code CWE
  • Channel Accessible by Non-Endpoint CWE

Impacts

  • CAPEC-94 Adversary in the Middle (AiTM)
  • CAPEC-142 DNS Cache Poisoning
  • CAPEC-248 Command Injection