{"vulnerability": "CVE-2026-74233", "sightings": [{"uuid": "661273d4-b376-495a-b0b7-cfd42db8b3d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mu7rm3filz22", "content": "\ud83d\udce2 Ces routeurs chinois peuvent \u00eatre contr\u00f4l\u00e9s \u00e0 distance sans authentification - CVE-2026-74233 CVE-2026-74232\n\nDeux nouveaux implants ont \u00e9t\u00e9 d\u00e9tect\u00e9s dans des routeurs du fabricant chinois Zbtlink, \u00e0 l\u2019origine d\u2019une porte d\u00e9rob\u00e9e d\u00e9couverte d\u00e9but ao\u00fbt sur une vingtaine de mod\u00e8l\u2026\n\n#CVE #Cyberveille", "creation_timestamp": "2026-08-29T11:30:07.852684Z"}, {"uuid": "fbab42d8-0308-444d-ad81-3f9fe53eba27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html", "content": "VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.", "creation_timestamp": "2026-08-29T01:00:35.647241Z"}, {"uuid": "f8a65d0e-9e3b-4e8a-81ca-1841fcca68af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://bsky.app/profile/unrayocruel.bsky.social/post/3mu6deahyus25", "content": "Los routers ZBT fabricados en China se env\u00edan con dos implantes que otorgan acceso de administrador a atacantes no autenticados.\n SPEAKINGSTONE (CVE-2026-74232) y DARKLANTERN (CVE-2026-74233), capaces de permitir a atacantes remotos no autenticados ejecutar comandos con privilegios de root.", "creation_timestamp": "2026-08-28T21:42:36.081711Z"}, {"uuid": "2c87fc54-92ee-4708-b977-43ee57cc0fef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mu2ziceyq22t", "content": "\ud83d\udea8 CVE-2026-74233 \u2014 CVSS 9.3 CRITICAL\n\nZbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-74233\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-27T14:07:52.288817Z"}, {"uuid": "843e460b-2568-4dce-96b5-fbd179e993e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117168418324906939", "content": "Bugdoor too?\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74233\n\nZbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.", "creation_timestamp": "2026-08-27T16:29:40.776815Z"}, {"uuid": "3e8ed108-c5c1-420e-aacd-e1886ccb8b46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mu3d5fypqv26", "content": "\ud83d\udd34 CVE-2026-74233 - Critical (9.8)\n\nZbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-74233/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-27T17:00:45.024893Z"}, {"uuid": "10e32193-d183-4eed-92c3-311f334ca6af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://t.me/pphm_HackerNews/2920", "content": "\ud83d\udd34 China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access\n\nVulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.\n\nVulnCheck, which assigned both identifiers as a CVE Numbering Authority (CNA), rated each 9.3 on the CVSS 4.0 scoring system and 9.8 on CVSS 3.1. Both vectors record a network attack requiring no privileges and no user interaction.", "creation_timestamp": "2026-08-29T00:00:07.864508Z"}, {"uuid": "c9e2db1c-4efb-48f1-b92c-eb478e4e53b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html", "content": "VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.", "creation_timestamp": "2026-08-28T16:00:54.359687Z"}, {"uuid": "ab60f363-b439-4f88-915d-67c35c242b52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mu4fn2tzft2b", "content": "VulnCheck found a ZBT router backdoor in firmware, tracked as CVE-2026-74232 and CVE-2026-74233, granting unauthenticated root over the internet.\n\n#ZBT #SupplyChain #Backdoor #RouterSecurity #VulnCheck", "creation_timestamp": "2026-08-28T03:18:01.991845Z"}, {"uuid": "c0fa2276-5b10-4ae8-86d7-c0b018f77688", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mu4patuxf525", "content": "CVE-2026-74233\nSeveral Zbtlink router models and some other devices run a background service that can be tricked by an unauthenticated network packet. An attacker who can reach the device on UDP port 9992 can cause it to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-28T06:10:04.355755Z"}, {"uuid": "6df0305c-da67-408c-9bf8-d5b8b0e98c29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://t.me/pphm_HackerNews/2920", "content": "\ud83d\udd34 China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access\n\nVulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.\n\nVulnCheck, which assigned both identifiers as a CVE Numbering Authority (CNA), rated each 9.3 on the CVSS 4.0 scoring system and 9.8 on CVSS 3.1. Both vectors record a network attack requiring no privileges and no user interaction.", "creation_timestamp": "2026-08-28T18:00:05.068695Z"}, {"uuid": "9971015d-ae5c-432f-bb36-11e751e28482", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "Telegram/q4w7ZKZ0cDl8jF65XtpHWB3xtg4Yw9cQXGu86S8yQmpVqQ", "content": "", "creation_timestamp": "2026-08-29T03:00:04.497311Z"}, {"uuid": "d2429074-4de3-4331-8310-2455524f1314", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "published-proof-of-concept", "source": "Telegram/q4w7ZKZ0cDl8jF65XtpHWB3xtg4Yw9cQXGu86S8yQmpVqQ", "content": "", "creation_timestamp": "2026-08-30T00:00:55.550165Z"}]}