Description (CNA)
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Zbtlink / WE1326 | affected 19.1101 |
| Zbtlink / WE2426-C | affected 19.1112 |
| Zbtlink / WE357 | affected 19.1101 |
| Zbtlink / WE5926 | affected 19.1101 |
| Zbtlink / WE5926-EC_QP | affected 20.0516 |
| Zbtlink / WE5926-WD | affected 19.1101 |
| Zbtlink / WE826-Q | affected 19.1101 |
| Zbtlink / WE826-T2 | affected 19.1101 |
| Zbtlink / WE826-WD | affected 19.1101 |
| Zbtlink / WF3526-P | affected 19.051 |
| Zbtlink / WG108 | affected 19.1101 |
| Zbtlink / WG3526 | affected 19.1101 |
| Unknown / CTN720-W1 | affected 19.1101 |
| Unknown / LF-1541 | affected 19.1101 |
| Unknown / MT7620N | affected 19.1101 |
| Unknown / WRC1 | affected 20.0622 |
CWE
CWE-321, CWE-78
References
- http://vulncheck.com/blog/zbt-darklantern-speakingstone
- https://www.vulncheck.com/advisories/zbtlink-mqwrt-infosrvd-command-injection
ADP enrichment
No English description supplied.
No references supplied.