Zbtlink WE1326

CVE-2026-74233, tracked as DARKLANTERN, is an unauthenticated OS command injection in the infosrvd service (UDP/9992) baked into Zbtlink router firmware. Affected models include WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, WG3526 (firmware 19.1101), WE2426-C (19.1112), WE5926-EC_QP (20.0516), and WF3526-P (19.051). The authentication mechanism uses a hardcoded salt (mqonu.com) and an all-zero MAC wildcard bypass, meaning any remote attacker can forge valid command packets and execute arbitrary commands as root. This is a companion finding to CVE-2026-66747 (ENDLESSDOORS), a separate embedded reverse-shell implant in the same product line. Researcher Jacob Baines of VulnCheck disclosed both on August 27, 2026.

The vendor CVSS of 9.8 CRITICAL is technically accurate for the bug class — it is textbook unauth network RCE as root on a boundary device with zero friction. However, the severity label is misleading for enterprise defenders because the affected product is an $88 consumer-grade LTE router sold through Amazon and AliExpress, not an enterprise-class appliance. VulnCheck's own internet scan found only 203 exposed instances globally across 22 countries. The odds that your 10,000-host enterprise runs Zbtlink firmware are vanishingly small. If you *do* have one, it's shadow IT — a remote worker's personal LTE failover or a forgotten field device. The vuln is real and brutal, but the blast radius for a typical enterprise is near zero.

Why this verdict

• Installed base is negligible for enterprise. Zbtlink routers are $88 consumer devices sold via Amazon and AliExpress. They have no enterprise sales channel, no central management console, no SOC integration. The probability that a 10,000-host enterprise has even one is <1%.
• No patch exists. Even if you find one in your environment, there is no vendor fix — the only remediation is device replacement. This shifts the action from 'patch' to 'discover and decommission,' which is a different operational workflow.
• Role multiplier: consumer edge, not enterprise edge. While these are technically network boundary devices, they do not serve the same role as FortiGate, Palo Alto, or Cisco ASA in enterprise deployments. The high-value network-edge floor (HIGH/CRITICAL) applies to devices that canonically protect enterprise perimeters — Zbtlink routers do not. Fewer than 0.01% of enterprise perimeters use these devices.
• White-label risk adds uncertainty. The Deep Orange 3G/4G/LTE Router is a rebranded WE826-T2. Other white-label variants may exist under unrecognized brand names, slightly increasing shadow IT risk. This prevents a full downgrade to LOW.

Why not higher?

The vulnerability is technically a perfect 9.8 — unauth remote root RCE with zero complexity. If this were in a Fortinet or Cisco product with millions of enterprise deployments, it would remain CRITICAL without question. However, the network-edge floor rule requires ≥1% of the installed base to canonically serve enterprise perimeter roles, and Zbtlink falls far below that threshold. There is no KEV listing and no confirmed exploitation campaign.

Why not lower?

Despite the tiny installed base, the white-label rebranding problem means some units could lurk undetected in enterprise environments as shadow IT LTE failover devices. The complete absence of a vendor patch and the supply-chain implications (firmware ships with *two* separate implants) warrant enough attention to scan and verify. A LOW or IGNORE rating would risk missing a rogue device that provides unauth root access to whatever subnet it serves.

1. Scan your network for UDP/9992 listeners — Use the VulnCheck-published 19-byte info probe or nmap UDP scan (nmap -sU -p 9992 <range>) to identify any DARKLANTERN instances in your environment. This is a discovery action, not a patch — run it within the 365-day remediation window, but given the severity of the underlying bug, prioritize within 30 days if you suspect shadow IT LTE devices.
2. Block UDP/9992 inbound at the perimeter firewall — If you cannot immediately locate and remove devices, block UDP/9992 at your internet edge to prevent external exploitation. This does not protect against LAN-side attacks but eliminates the remote attack vector.
3. Decommission any discovered Zbtlink/ZBT-branded devices — There is no firmware fix. The only remediation is physical replacement with a supported enterprise device. If discovered, remove from the network immediately and replace with a managed appliance.
4. Add Suricata/Snort signatures for DARKLANTERN traffic — VulnCheck published Suricata rules that detect the info probe, command injection attempts, and output exfiltration on TCP/8897. Deploy these to your IDS/IPS to detect exploitation attempts against any undiscovered devices.

Run this from any Linux/macOS workstation or your vulnerability scanner host. It sends the DARKLANTERN info probe to a target IP on UDP/9992 and checks for a response. Usage: bash check_darklantern.sh <target_ip>. No special privileges needed beyond the ability to send UDP packets.

#!/usr/bin/env bash
# check_darklantern.sh — Detect CVE-2026-74233 DARKLANTERN (infosrvd on UDP/9992)
# Usage: bash check_darklantern.sh <target_ip>
# Exit codes: 0 = VULNERABLE, 1 = PATCHED/NOT_LISTENING, 2 = UNKNOWN/ERROR

set -euo pipefail

TARGET="${1:-}"
PORT=9992
TIMEOUT=5

if [ -z "$TARGET" ]; then
  echo "Usage: $0 <target_ip>"
  exit 2
fi

# Require nc (netcat) with UDP support
if ! command -v nc &>/dev/null && ! command -v ncat &>/dev/null; then
  echo "UNKNOWN — nc or ncat not found. Install nmap or netcat."
  exit 2
fi

NC_CMD="nc"
command -v ncat &>/dev/null && NC_CMD="ncat"

# DARKLANTERN 19-byte info probe
PROBE=$(printf '\x0c\x16\x1f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01')

echo "[*] Sending DARKLANTERN info probe to $TARGET:$PORT/udp..."

RESPONSE=$(echo -n "$PROBE" | timeout "$TIMEOUT" $NC_CMD -u -w "$TIMEOUT" "$TARGET" "$PORT" 2>/dev/null || true)

if [ -z "$RESPONSE" ]; then
  echo "PATCHED — No response on UDP/$PORT (service not listening or filtered)."
  exit 1
fi

# Check for typical DARKLANTERN response indicators (cleartext model/MAC/firmware)
if echo "$RESPONSE" | grep -qiE '(WE[0-9]|WG[0-9]|ZBT|firmware|MAC)'; then
  echo "VULNERABLE — DARKLANTERN (CVE-2026-74233) detected on $TARGET:$PORT."
  echo "Device responded with identification data. Decommission this device immediately."
  exit 0
else
  echo "UNKNOWN — UDP/$PORT responded but content does not match DARKLANTERN fingerprint."
  echo "Manual review recommended."
  exit 2
fi

Sources

1. VulnCheck — DARKLANTERN & SPEAKINGSTONE Blog
2. VulnCheck — ENDLESSDOORS Advisory
3. The Hacker News — China-Made ZBT Routers Ship With Two Implants
4. Canadian Centre for Cyber Security — Zbtlink Advisory AV26-779
5. SecurityOnline — CVE-2026-66747 ENDLESSDOORS Analysis
6. The Register — Chinese Router Vendor Denies Backdoors
7. Tom's Hardware — Surveillance Implants in Chinese-Made Routers