CVE-2026-74233: Use of Hard-coded Cryptographic Key in Zbtlink WE1326

The vulnerability CVE-2026-74233 affects Zbtlink WE1326 and multiple other models running specific firmware versions. The infosrvd service listens on UDP port 9992 and implements authentication using a hardcoded salt and an all-zero wildcard MAC bypass, which effectively disables authentication. This flaw allows a remote unauthenticated attacker to send specially crafted UDP packets to the service and execute arbitrary commands with root privileges. The vulnerability is present in firmware version 19.1101 for WE1326 and other models, as well as specific versions for other devices listed. No official remediation or patch information is currently available.

A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary commands as root on affected devices, potentially leading to full device compromise. The authentication bypass due to hardcoded cryptographic keys and wildcard MAC addresses makes the attack trivial to perform remotely over the network without any user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to UDP port 9992 on affected devices to trusted networks only to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.