Loading vulnerability…
DARKLANTERN Unauthenticated Root Command Injection in Zbtlink infosrvd
CVE-2026-74233, known as DARKLANTERN, is an unauthenticated OS command-injection vulnerability in the infosrvd service included in multiple Zbtlink and white-labeled router firmware builds. The UDP service accepts a supplied shell command that is passed to the operating system for execution. Its nominal authentication is ineffective: token generation relies on a hardcoded salt, and MAC-address validation accepts an all-zero six-byte value as a wildcard. This permits a remote unauthenticated attacker to submit a crafted UDP command packet and execute arbitrary commands with root privileges. Affected products include specified firmware builds for Zbtlink WE1326, WE357, WE5926 variants, WE826 variants, WG108, WG3526, WE2426-C, WE5926-EC_QP, and WF3526-P, as well as CTN720-W1, LF-1541, MT7620N, and WRC1 devices.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation gives an unauthenticated remote attacker arbitrary root-level command execution on the router. The attacker can fully compromise the device, alter routing or DNS configuration, intercept or redirect network traffic, access credentials and configuration data handled by the router, establish persistence or tunnels, and disrupt device or network availability. Because the affected service may be reachable through the default firewall configuration, compromise can be performed remotely without user interaction or prior privileges.
If you can’t patch tonight, do this now.
Block or strictly restrict untrusted inbound access to UDP port 9992 at Internet gateways, perimeter firewalls, and management-network boundaries. Do not expose affected routers directly to the Internet. Segment affected devices into restricted management networks and permit access only from explicitly authorized administrative hosts where the service cannot be disabled. Monitor for unexpected traffic targeting UDP port 9992 and for unauthorized router configuration, DNS, routing, or administrative changes.
Patch, then assume compromise.
No fixed firmware release is identified. Apply vendor-provided corrected firmware immediately when it becomes available, after verifying that the update removes or securely restricts the vulnerable infosrvd functionality. Where a supported fix is unavailable, replace affected devices with supported hardware or remove them from security-sensitive networks. Given root-level exposure, assess affected devices for compromise and reset or rebuild device configuration and credentials as appropriate after remediation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.