{"vulnerability": "CVE-2026-74232", "sightings": [{"uuid": "2ff58bd1-b52d-464e-98e6-0aab29a6572b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mu7rm3filz22", "content": "\ud83d\udce2 Ces routeurs chinois peuvent \u00eatre contr\u00f4l\u00e9s \u00e0 distance sans authentification - CVE-2026-74233 CVE-2026-74232\n\nDeux nouveaux implants ont \u00e9t\u00e9 d\u00e9tect\u00e9s dans des routeurs du fabricant chinois Zbtlink, \u00e0 l\u2019origine d\u2019une porte d\u00e9rob\u00e9e d\u00e9couverte d\u00e9but ao\u00fbt sur une vingtaine de mod\u00e8l\u2026\n\n#CVE #Cyberveille", "creation_timestamp": "2026-08-29T11:30:07.911695Z"}, {"uuid": "42e151c7-cd9c-4b1a-8391-077614f0a19a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://bsky.app/profile/unrayocruel.bsky.social/post/3mu6deahyus25", "content": "Los routers ZBT fabricados en China se env\u00edan con dos implantes que otorgan acceso de administrador a atacantes no autenticados.\n SPEAKINGSTONE (CVE-2026-74232) y DARKLANTERN (CVE-2026-74233), capaces de permitir a atacantes remotos no autenticados ejecutar comandos con privilegios de root.", "creation_timestamp": "2026-08-28T21:42:36.011597Z"}, {"uuid": "a58a2fe6-0d00-42ba-9354-899cabf13f72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mu2zi2brta2p", "content": "\ud83d\udea8 CVE-2026-74232 \u2014 CVSS 9.3 CRITICAL\n\nZbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2....\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-74232\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-27T14:07:43.356265Z"}, {"uuid": "3e9905f5-f0f8-4028-b786-3998e132882a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-74232", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117168410801839477", "content": "Fucking LMAO\nhttps://nvd.nist.gov/vuln/detail/cve-2026-74232\n\nZbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.", "creation_timestamp": "2026-08-27T16:27:47.989699Z"}, {"uuid": "96af095e-b4b5-4bd0-9a44-730c231acb9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html", "content": "VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.", "creation_timestamp": "2026-08-29T01:00:35.583766Z"}, {"uuid": "b44499a0-adf0-4dd5-9d11-bcb10e1f3f05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mu3d5nbb3o2r", "content": "\ud83d\udd34 CVE-2026-74232 - Critical (9.8)\n\nZbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmwar...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-74232/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-27T17:00:52.619066Z"}, {"uuid": "23e7c2b4-cb6a-4890-ba97-fe6de4728740", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://t.me/pphm_HackerNews/2920", "content": "\ud83d\udd34 China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access\n\nVulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.\n\nVulnCheck, which assigned both identifiers as a CVE Numbering Authority (CNA), rated each 9.3 on the CVSS 4.0 scoring system and 9.8 on CVSS 3.1. Both vectors record a network attack requiring no privileges and no user interaction.", "creation_timestamp": "2026-08-29T00:00:07.896116Z"}, {"uuid": "aafa7e96-1367-4d49-a3e1-e47e2b33e5c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html", "content": "VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.", "creation_timestamp": "2026-08-28T16:00:54.308527Z"}, {"uuid": "db7b298f-d95f-4f7c-bb22-c218b0627fc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mu4fn2tzft2b", "content": "VulnCheck found a ZBT router backdoor in firmware, tracked as CVE-2026-74232 and CVE-2026-74233, granting unauthenticated root over the internet.\n\n#ZBT #SupplyChain #Backdoor #RouterSecurity #VulnCheck", "creation_timestamp": "2026-08-28T03:18:01.926874Z"}, {"uuid": "881dfc73-ac0c-4618-8f8a-422782b92579", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mu4qwiymq42y", "content": "CVE-2026-74232\nSeveral firmware versions for Zbtlink, MoreQuick, AP, HK and MAP devices contain code that opens an unauthenticated UDP channel to a fixed server. Anyone on the same network can take control, run commands as\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-28T06:40:04.666015Z"}, {"uuid": "a00d49d7-65ac-4576-9c22-9a866efcf262", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://t.me/pphm_HackerNews/2920", "content": "\ud83d\udd34 China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access\n\nVulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.\n\nVulnCheck, which assigned both identifiers as a CVE Numbering Authority (CNA), rated each 9.3 on the CVSS 4.0 scoring system and 9.8 on CVSS 3.1. Both vectors record a network attack requiring no privileges and no user interaction.", "creation_timestamp": "2026-08-28T18:00:05.107011Z"}, {"uuid": "265aa952-6747-4269-97ee-21fa837acd7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "Telegram/q4w7ZKZ0cDl8jF65XtpHWB3xtg4Yw9cQXGu86S8yQmpVqQ", "content": "", "creation_timestamp": "2026-08-29T03:00:04.469196Z"}]}