| Zbtlink WE1326 Series
|
|
Security Grade
Calculator v1
|
Zbtlink WE1326 Wireless Router
Release Date: 2016-08-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
|
| Prior attacks
|
None
|
🔗 Proof
|
|
| Updatability
|
Rare
|
🔗 Proof
|
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
No
|
🔗 Proof
|
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
|
| Storage
|
No encryption
|
🔗 Proof
|
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Absent
|
🔗 Proof
|
|
| Authentication
|
Absent
|
🔗 Proof
|
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
|
| Event logging
|
Absent
|
🔗 Proof
|
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded Linux firmware (versions 19.051–20.0622 affected) (Companion App: Web interface)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Wi-Fi, Ethernet, UDP/9992 (infosrvd service)
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Zbtlink WE1326, WE357, WE5926, WE826-Q, WG108, WG3526 and other models running firmware versions 19.051 through 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP port 9992). The service’s authentication relies on a hardcoded salt and an all-zero wildcard MAC bypass, rendering it completely ineffective. A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root, gaining full control over the device. Impact includes data exfiltration, botnet recruitment, network pivoting, and denial-of-service. No patch status was publicly documented at the time of disclosure . Disclosed Aug 2026.
