You do not have permission to edit this page, for the following reasons:
Zbtlink WE1326, WE357, WE5926, WE826-Q, WG108, WG3526 and other models running firmware versions 19.051 through 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP port 9992). The serviceโs authentication relies on a hardcoded salt and an all-zero wildcard MAC bypass, rendering it completely ineffective. A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root, gaining full control over the device. Impact includes data exfiltration, botnet recruitment, network pivoting, and denial-of-service. No patch status was publicly documented at the time of disclosure . Disclosed Aug 2026.
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
