Zbtlink WE1326 Series

Zbtlink WE1326 Series
Security Grade D Calculator v	Zbtlink WE1326 Wireless Router Brand: Zbtlink (Parent: Zbtlink) Category: Wi-Fi router / networking device • Model / Gen: WE1326 WE1326 Release Date: 2016-08-01 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof
Known vulnerabilities	Very common	🔗 Proof
Prior attacks	None	🔗 Proof
Updatability	Rare	🔗 Proof
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	No	🔗 Proof
Communications	Encrypted with obselete encryption	🔗 Proof
Storage	No encryption	🔗 Proof
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Absent	🔗 Proof
Authentication	Absent	🔗 Proof
Brute-force protection	Absent	🔗 Proof
Event logging	Absent	🔗 Proof
Passwords	Default/Common/Easy to guess	🔗 Proof
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded Linux firmware (versions 19.051–20.0622 affected) (Companion App: Web interface)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Wi-Fi, Ethernet, UDP/9992 (infosrvd service)
Physical (Dimensions & Mass)	Dimensions: • Mass:

Zbtlink WE1326, WE357, WE5926, WE826-Q, WG108, WG3526 and other models running firmware versions 19.051 through 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP port 9992). The service’s authentication relies on a hardcoded salt and an all-zero wildcard MAC bypass, rendering it completely ineffective. A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root, gaining full control over the device. Impact includes data exfiltration, botnet recruitment, network pivoting, and denial-of-service. No patch status was publicly documented at the time of disclosure . Disclosed Aug 2026.