Executive brief
Zbtlink routers contain a backdoor service called infosrvd that runs with root privileges and listens on the public internet. An attacker can send a specially crafted network packet to execute arbitrary commands on the device without any authentication, giving them complete control over the router. This affects hundreds of internet-facing devices globally and enables attackers to intercept traffic, modify network settings, or use the router as a foothold for further attacks.
Technical details
The infosrvd service on affected Zbtlink routers implements a backdoor called DARKLANTERN that listens on UDP port 9992 and is reachable from the internet by default firewall rules. The vulnerability combines OS command injection (CWE-78) and hard-coded cryptographic keys (CWE-321): command packets are accepted if they contain a valid four-byte MD5 checksum computed over a hard-coded salt "mqonu.com" (allowing trivial token forgery) and pass a MAC address check that can be bypassed by sending all-zero MAC bytes. An attacker can send a crafted UDP packet with a command payload, semicolon-separated shell metacharacters, and a forged token to execute arbitrary commands as root with no authentication or user interaction required. The vulnerability is intentional design rather than a defect, attributed to MoreQuick (the Chinese OEM that developed the firmware). No patch has been announced; affected devices require firmware updates from the vendor.
Affected products
- Zbtlink WE1326 19.1101
- Zbtlink WE357 19.1101
- Zbtlink WE5926 19.1101
- Zbtlink WE5926-WD 19.1101
- Zbtlink WE5926-EC_QP 20.0516
- Zbtlink WE826-Q 19.1101
- Zbtlink WE826-T2 19.1101
- Zbtlink WE826-WD 19.1101
- Zbtlink WE2426-C 19.1112
- Zbtlink WF3526-P 19.051
- Zbtlink WG108 19.1101
- Zbtlink WG3526 19.1101
- Zbtlink CTN720-W1 19.1101
- Zbtlink LF-1541 19.1101
- Zbtlink MT7620N 19.1101
- Zbtlink WRC1 20.0622
Timeline
- 2026-08-27: disclosed: Vulnerability disclosed by VulnCheck researcher Jacob Baines
- 2026-08-27: exploited: Scanning between 2026-08-18 and 2026-08-21 identified 203 internet-facing instances across 22 countries with active implants