CVE-2026-74232 in L3_V2_8
Summary
by MITRE • 08/27/2026
Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The identified vulnerability affects a broad range of networking equipment from vendors including Zbtlink, MoreQuick, AP522, AP7628, HC5661A, APG721B, HK300, and MAP-N10. These devices ship with firmware versions that contain a persistent backdoor command-and-control implant known as yunmgrd. This malicious component is designed to establish communication channels with hardcoded external servers, creating a significant security risk for users of these specific hardware models and software revisions. The presence of such an implant indicates a severe compromise in the supply chain or development process, where unauthorized remote access mechanisms are embedded directly into the device firmware rather than being introduced through subsequent updates or user configuration errors.
The core technical flaw lies in the operational design of the yunmgrd service, which listens for commands over an unauthenticated cleartext UDP channel. Because no authentication mechanism is required to interact with this interface, any remote attacker positioned on the network path can intercept and hijack these communications. The use of User Datagram Protocol (UDP) further exacerbates the risk by allowing connectionless communication that is easier to spoof or manipulate compared to stateful TCP connections. Furthermore, the transmission occurs in cleartext, meaning that all data exchanged between the compromised device and the command-and-control server can be easily captured via standard network sniffing tools without any need for decryption keys or complex cryptographic attacks.
The operational impact of this vulnerability is severe due to the privilege level granted to the executed commands. An unauthenticated attacker who successfully hijacks the channel gains root-level access on the affected device. This highest level of system privileges allows the adversary to perform a wide array of destructive and intrusive actions. Specifically, attackers can modify DNS entries to redirect traffic for malicious purposes such as phishing or man-in-the-middle attacks. They are also capable of exfiltrating sensitive PPPoE credentials stored within the device configuration, which compromises not only the local network but potentially broader internet access accounts associated with those credentials. Additionally, the ability to open reverse SSH tunnels provides a persistent and stealthy method for maintaining long-term remote control over the compromised infrastructure, bypassing many traditional perimeter security controls.
This vulnerability aligns closely with several established industry standards and frameworks that categorize such flaws. It is primarily classified under CWE-798: Use of Hard-coded Credentials, as the device relies on hardcoded mechanisms to facilitate unauthorized access rather than dynamic or user-managed authentication methods. The exploitation technique involves intercepting unencrypted communications, which corresponds to CWE-319: Cleartext Transmission of Sensitive Information. From a tactical perspective within the MITRE ATT&CK framework, this behavior maps to T1071 Application Layer Protocol for command and control traffic, specifically leveraging UDP-based protocols that are often less monitored by security appliances compared to HTTP or HTTPS. The ability to modify DNS entries relates to T1098: Account Manipulation or potentially data exfiltration techniques depending on the specific payload delivered through the tunnel.
Mitigation strategies must address both immediate remediation and long-term supply chain integrity. Users of the affected firmware versions should immediately update their devices to patched releases that remove the yunmgrd backdoor if such updates are provided by the vendor. In cases where official patches are unavailable, network segmentation is critical; administrators should isolate these IoT or networking devices from sensitive internal networks using VLANs and strict firewall rules that block outbound UDP traffic on non-standard ports associated with C2 communications. Additionally, deploying intrusion detection systems configured to identify patterns consistent with yunmgrd communication can help in early detection of exploitation attempts. Organizations must also conduct thorough audits of their network infrastructure for any signs of DNS manipulation or unauthorized SSH tunnels as indicators of compromise resulting from this specific vulnerability.