{"vulnerability": "cve-2026-7423", "sightings": [{"uuid": "c56ba307-7992-44ef-8c9c-85eced7b30fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74234", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mteey7jlop2k", "content": "CVE-2026-74234 - Critical XSS in Legora. Mermaid block + JS front-matter triggers eval() before sanitization. CVSS 7.7. Arbitrary JS in victim's browser. Patch unknown. Update immediately. #CVE #Legora #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-74234/", "creation_timestamp": "2026-08-18T14:02:22.964208Z"}, {"uuid": "4e028616-963f-4d85-80e5-847cd5391fe9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74234", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117116878409023093", "content": "CVE-2026-74234 - Critical XSS in Legora. Mermaid block + JS front-matter triggers eval() before sanitization. CVSS 7.7. Arbitrary JS in victim's browser. Patch unknown. Update immediately. #CVE #Legora #infosec\nhttps://www.valtersit.com/cve/CVE-2026-74234/", "creation_timestamp": "2026-08-18T14:02:41.847859Z"}, {"uuid": "661273d4-b376-495a-b0b7-cfd42db8b3d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mu7rm3filz22", "content": "\ud83d\udce2 Ces routeurs chinois peuvent \u00eatre contr\u00f4l\u00e9s \u00e0 distance sans authentification - CVE-2026-74233 CVE-2026-74232\n\nDeux nouveaux implants ont \u00e9t\u00e9 d\u00e9tect\u00e9s dans des routeurs du fabricant chinois Zbtlink, \u00e0 l\u2019origine d\u2019une porte d\u00e9rob\u00e9e d\u00e9couverte d\u00e9but ao\u00fbt sur une vingtaine de mod\u00e8l\u2026\n\n#CVE #Cyberveille", "creation_timestamp": "2026-08-29T11:30:07.852684Z"}, {"uuid": "8500445e-50ef-4f1a-9b18-71d1edc9b6eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mucsehpuw32t", "content": "VulnCheck found two more factory backdoors in ZBT router firmware: SPEAKINGSTONE and DARKLANTERN (CVE-2026-74232/74233).\n\nOne calls out, one listens on an open port for anyone to reach as root.\n\nNo fix. Replace the hardware.", "creation_timestamp": "2026-08-30T16:21:46.146410Z"}, {"uuid": "2ff58bd1-b52d-464e-98e6-0aab29a6572b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mu7rm3filz22", "content": "\ud83d\udce2 Ces routeurs chinois peuvent \u00eatre contr\u00f4l\u00e9s \u00e0 distance sans authentification - CVE-2026-74233 CVE-2026-74232\n\nDeux nouveaux implants ont \u00e9t\u00e9 d\u00e9tect\u00e9s dans des routeurs du fabricant chinois Zbtlink, \u00e0 l\u2019origine d\u2019une porte d\u00e9rob\u00e9e d\u00e9couverte d\u00e9but ao\u00fbt sur une vingtaine de mod\u00e8l\u2026\n\n#CVE #Cyberveille", "creation_timestamp": "2026-08-29T11:30:07.911695Z"}, {"uuid": "1ddf7d8b-71a3-4e61-abdc-0a1e534b6c2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74238", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtcilctdkz2b", "content": "\ud83d\udfe0 CVE-2026-74238 - High (7.5)\n\nTIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::un...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-74238/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-17T20:01:27.230719Z"}, {"uuid": "bf6fd100-eb65-44bd-b4be-30ddc613ec66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74238", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/dvtsf5aqf67o4", "content": "CVE-2026-74238 - TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder\nCVE ID : CVE-2026-74238\n \n Published : Aug. 17, 2026, 7:16 p.m. | 56\u00a0minutes ago\n \n Description : TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::...", "creation_timestamp": "2026-08-17T20:42:40.534458Z"}, {"uuid": "e520fd24-c0c8-4a19-bc2f-3780f5eaeba1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74234", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mtclemsxsi2t", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-74234](https://legora.com/)\nLegora before 2026-08-14 contains a cross-site scripting vu...\nhttps://legora.com/ #CVE #ZeroDay #PatchManagement", "creation_timestamp": "2026-08-17T20:51:22.558030Z"}, {"uuid": "d2747b79-bd90-40b9-8ab7-ef3fd13d1cc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74234", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtclvcn4ep2r", "content": "\ud83d\udfe0 CVE-2026-74234 - High (7.7)\n\nLegora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-74234/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-17T21:00:43.811624Z"}, {"uuid": "fbab42d8-0308-444d-ad81-3f9fe53eba27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html", "content": "VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.", "creation_timestamp": "2026-08-29T01:00:35.647241Z"}, {"uuid": "42e151c7-cd9c-4b1a-8391-077614f0a19a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://bsky.app/profile/unrayocruel.bsky.social/post/3mu6deahyus25", "content": "Los routers ZBT fabricados en China se env\u00edan con dos implantes que otorgan acceso de administrador a atacantes no autenticados.\n SPEAKINGSTONE (CVE-2026-74232) y DARKLANTERN (CVE-2026-74233), capaces de permitir a atacantes remotos no autenticados ejecutar comandos con privilegios de root.", "creation_timestamp": "2026-08-28T21:42:36.011597Z"}, {"uuid": "f8a65d0e-9e3b-4e8a-81ca-1841fcca68af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://bsky.app/profile/unrayocruel.bsky.social/post/3mu6deahyus25", "content": "Los routers ZBT fabricados en China se env\u00edan con dos implantes que otorgan acceso de administrador a atacantes no autenticados.\n SPEAKINGSTONE (CVE-2026-74232) y DARKLANTERN (CVE-2026-74233), capaces de permitir a atacantes remotos no autenticados ejecutar comandos con privilegios de root.", "creation_timestamp": "2026-08-28T21:42:36.081711Z"}, {"uuid": "a58a2fe6-0d00-42ba-9354-899cabf13f72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mu2zi2brta2p", "content": "\ud83d\udea8 CVE-2026-74232 \u2014 CVSS 9.3 CRITICAL\n\nZbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2....\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-74232\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-27T14:07:43.356265Z"}, {"uuid": "2c87fc54-92ee-4708-b977-43ee57cc0fef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mu2ziceyq22t", "content": "\ud83d\udea8 CVE-2026-74233 \u2014 CVSS 9.3 CRITICAL\n\nZbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-74233\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-27T14:07:52.288817Z"}, {"uuid": "3e9905f5-f0f8-4028-b786-3998e132882a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-74232", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117168410801839477", "content": "Fucking LMAO\nhttps://nvd.nist.gov/vuln/detail/cve-2026-74232\n\nZbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.", "creation_timestamp": "2026-08-27T16:27:47.989699Z"}, {"uuid": "843e460b-2568-4dce-96b5-fbd179e993e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117168418324906939", "content": "Bugdoor too?\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74233\n\nZbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.", "creation_timestamp": "2026-08-27T16:29:40.776815Z"}, {"uuid": "96af095e-b4b5-4bd0-9a44-730c231acb9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html", "content": "VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.", "creation_timestamp": "2026-08-29T01:00:35.583766Z"}, {"uuid": "3e8ed108-c5c1-420e-aacd-e1886ccb8b46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mu3d5fypqv26", "content": "\ud83d\udd34 CVE-2026-74233 - Critical (9.8)\n\nZbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-74233/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-27T17:00:45.024893Z"}, {"uuid": "b44499a0-adf0-4dd5-9d11-bcb10e1f3f05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mu3d5nbb3o2r", "content": "\ud83d\udd34 CVE-2026-74232 - Critical (9.8)\n\nZbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmwar...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-74232/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-27T17:00:52.619066Z"}, {"uuid": "10e32193-d183-4eed-92c3-311f334ca6af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://t.me/pphm_HackerNews/2920", "content": "\ud83d\udd34 China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access\n\nVulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.\n\nVulnCheck, which assigned both identifiers as a CVE Numbering Authority (CNA), rated each 9.3 on the CVSS 4.0 scoring system and 9.8 on CVSS 3.1. Both vectors record a network attack requiring no privileges and no user interaction.", "creation_timestamp": "2026-08-29T00:00:07.864508Z"}, {"uuid": "23e7c2b4-cb6a-4890-ba97-fe6de4728740", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://t.me/pphm_HackerNews/2920", "content": "\ud83d\udd34 China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access\n\nVulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.\n\nVulnCheck, which assigned both identifiers as a CVE Numbering Authority (CNA), rated each 9.3 on the CVSS 4.0 scoring system and 9.8 on CVSS 3.1. Both vectors record a network attack requiring no privileges and no user interaction.", "creation_timestamp": "2026-08-29T00:00:07.896116Z"}, {"uuid": "aafa7e96-1367-4d49-a3e1-e47e2b33e5c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html", "content": "VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.", "creation_timestamp": "2026-08-28T16:00:54.308527Z"}, {"uuid": "c9e2db1c-4efb-48f1-b92c-eb478e4e53b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html", "content": "VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.", "creation_timestamp": "2026-08-28T16:00:54.359687Z"}, {"uuid": "db7b298f-d95f-4f7c-bb22-c218b0627fc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mu4fn2tzft2b", "content": "VulnCheck found a ZBT router backdoor in firmware, tracked as CVE-2026-74232 and CVE-2026-74233, granting unauthenticated root over the internet.\n\n#ZBT #SupplyChain #Backdoor #RouterSecurity #VulnCheck", "creation_timestamp": "2026-08-28T03:18:01.926874Z"}, {"uuid": "ab60f363-b439-4f88-915d-67c35c242b52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mu4fn2tzft2b", "content": "VulnCheck found a ZBT router backdoor in firmware, tracked as CVE-2026-74232 and CVE-2026-74233, granting unauthenticated root over the internet.\n\n#ZBT #SupplyChain #Backdoor #RouterSecurity #VulnCheck", "creation_timestamp": "2026-08-28T03:18:01.991845Z"}, {"uuid": "c0fa2276-5b10-4ae8-86d7-c0b018f77688", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mu4patuxf525", "content": "CVE-2026-74233\nSeveral Zbtlink router models and some other devices run a background service that can be tricked by an unauthenticated network packet. An attacker who can reach the device on UDP port 9992 can cause it to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-28T06:10:04.355755Z"}, {"uuid": "881dfc73-ac0c-4618-8f8a-422782b92579", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mu4qwiymq42y", "content": "CVE-2026-74232\nSeveral firmware versions for Zbtlink, MoreQuick, AP, HK and MAP devices contain code that opens an unauthenticated UDP channel to a fixed server. Anyone on the same network can take control, run commands as\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-28T06:40:04.666015Z"}, {"uuid": "6df0305c-da67-408c-9bf8-d5b8b0e98c29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "https://t.me/pphm_HackerNews/2920", "content": "\ud83d\udd34 China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access\n\nVulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.\n\nVulnCheck, which assigned both identifiers as a CVE Numbering Authority (CNA), rated each 9.3 on the CVSS 4.0 scoring system and 9.8 on CVSS 3.1. Both vectors record a network attack requiring no privileges and no user interaction.", "creation_timestamp": "2026-08-28T18:00:05.068695Z"}, {"uuid": "a00d49d7-65ac-4576-9c22-9a866efcf262", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "https://t.me/pphm_HackerNews/2920", "content": "\ud83d\udd34 China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access\n\nVulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.\n\nThe implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.\n\nVulnCheck, which assigned both identifiers as a CVE Numbering Authority (CNA), rated each 9.3 on the CVSS 4.0 scoring system and 9.8 on CVSS 3.1. Both vectors record a network attack requiring no privileges and no user interaction.", "creation_timestamp": "2026-08-28T18:00:05.107011Z"}, {"uuid": "265aa952-6747-4269-97ee-21fa837acd7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "seen", "source": "Telegram/q4w7ZKZ0cDl8jF65XtpHWB3xtg4Yw9cQXGu86S8yQmpVqQ", "content": "", "creation_timestamp": "2026-08-29T03:00:04.469196Z"}, {"uuid": "9971015d-ae5c-432f-bb36-11e751e28482", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "seen", "source": "Telegram/q4w7ZKZ0cDl8jF65XtpHWB3xtg4Yw9cQXGu86S8yQmpVqQ", "content": "", "creation_timestamp": "2026-08-29T03:00:04.497311Z"}, {"uuid": "bad5ebaf-e899-4372-bb5b-65e17988760c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74232", "type": "published-proof-of-concept", "source": "Telegram/q4w7ZKZ0cDl8jF65XtpHWB3xtg4Yw9cQXGu86S8yQmpVqQ", "content": "", "creation_timestamp": "2026-08-30T00:00:55.513265Z"}, {"uuid": "d2429074-4de3-4331-8310-2455524f1314", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74233", "type": "published-proof-of-concept", "source": "Telegram/q4w7ZKZ0cDl8jF65XtpHWB3xtg4Yw9cQXGu86S8yQmpVqQ", "content": "", "creation_timestamp": "2026-08-30T00:00:55.550165Z"}, {"uuid": "49def419-3389-4283-adea-6ee7111a8955", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74237", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ec5li47nvsswa", "content": "CVE-2026-74237 - GFI Exinda AI\nCVE ID : CVE-2026-74237\n \n Published : Sept. 4, 2026, 12:24 p.m. | 57\u00a0minutes ago\n \n Description : GFI Exinda AI before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function const...", "creation_timestamp": "2026-09-04T13:24:44.097613Z"}, {"uuid": "8a81f61b-4199-4ad0-8979-d5ebd488ef44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-74232", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-cfe18ce3-213e4f08a71a09d8", "content": "This Week in Security: Baked-in Malware, Freezers Not Freezing, Zoom Snoops Clipboards, and AI Makes Things Worse, Faster\nThe AI platform ServiceNow which offers both hosted and on-premises versions just patched a trifecta of CVSS-10 vulnerabilities.\nCVSS rankings are determined by the severity of a flaw, the ease of exploiting the bug, if authentication is required for exploitation, if the vulnerability exposes confidential data, and other criteria. A CVSS of 10 is as bad as it gets, and having three of them at once is certainly attention-getting. Of the three vulnerabilities fixed, one allowed unauthenticated modification of data in the hosted instance, a second allowed arbitrary code execution via the GraphQL interface, and the third allowed arbitrary SQL commands that could modify the database.\nServiceNow claims Adobe, Lenovo, Fedex, and Fujitsu among their high-profile customers. With luck, the vulnerabilities were patched before significant public exploitation could happen.\nRouter Malware\nPreviously in 2026 the US Government warned against embedded malware found in consumer routers, which may be linked to the FCC enacting bans against certification and import of foreign-made consumer devices. This week, the NVD (National Vulnerability Database) reported specific embedded malware in the Zbtlink and MoreQuick brands of devices.\nMultiple versions of the firmware, for multiple lines of products, contain a backdoor service that uses unencrypted UDP to connect to a command and control (C2) service. The service, or anyone able to intercept the network traffic, since it\u2019s unencrypted, can execute commands as root, allowing them to change configurations, open tunnels, or steal ISP credentials.\nThe malware is baked into the firmware, so removing it is impossible for most users: a factory reset wouldn\u2019t do. In theory if third-party firmware like OpenWRT supports these devices, the hardware could be made safer with a custom install.\nGiven how commonly the same device is marketed under dozens of names, likely the same devices and firmware have yet to be identified under other brands.\nVulnerability in Qubes\nThe security-focused distribution Qubes has an important security bulletin for recently discovered issues.\nQubes is built on top of the Xen virtualization system, where each application can be given a dedicated container. The utility to copy files from the primary container into an application container, qvm-copy-to-vm, displays a message if there is an error copying the file. To show the message, the utility launches kdialog with the error as arguments, but fails to ensure that the error doesn\u2019t include shell commands.\nThe system call used to show the alerts has the dangerous side effect of calling the command as if it was a normal shell. This is extremely powerful, but equally risky: a shell typically allows multiple commands per lines, require quoted strings to protect arguments with spaces or complex text, and can expand variables. Generating an error that escapes out of the message and runs arbitrary commands was all it took.\nQubes already has a fix ready and everyone getting standard updates should have it waiting.\nWere US Military Freezers Hacked?\nThe controls for the freezers used in the commissaries of a growing number of US military bases may have been compromised.\nIndependent researchers noticed growing reports in Reddit threads that freezer units were out of service, with other service members and families reporting the same. At least fourteen bases throughout the United States appear impacted, and the story has been picked up by the official military newspaper \u201cStars and Stripes\u201d as well as by mainstream media outlets.\nPosts by staff at the bases clarify that it was not a power loss or cooling loss, the fridges and freezers were placed in defrost mode where they self-heated. The commissaries are operated by the Defense Commissary Agency, with central monitoring and control of facilities. Central monitoring makes complete sense when you need to ensure devices are keeping food at a safe temperature, but something definitely seems to have gone wrong.\nDiving into it further, M. Elizabeth finds a post from August 9, 2026 describing vulnerabilities in the Danfoss controllers that allow unauthorized access to the refrigeration controller, and a second paper by the same team exposing over 20 vulnerabilities in Copeland refrigeration controllers that included full control of the unit settings. M. Elizabeth is careful to point out that without confirmation from the commissary agency, it\u2019s impossible to know for sure that this was a hack of the control system, but the evidence is mounting.\nBGP and SSL Hijack Used to Push Bad Updates\nVirtualizor, a web interface for managing virtual machines in an enterprise (bring-your-own AWS), was recently targeted in a global route hijacking scheme.\nBorder Gateway Protocol (BGP) is a core routing system underlying the Internet at large. Service providers use BGP to announce the ranges of IP addresses they handle and how to reach them. BGP is operated as basically a global gentleman\u2019s agreement: the protocol itself lacks any authentication or encryption. If you think this sounds vulnerable to disruption, you\u2019d be completely right.\nGlobal disruptions have happened accidentally, like when an ISP in Pakistan took down YouTube, deliberately, such as when thieves hijacked the routes to cryptocurrency exchanges, and mysteriously, like when China hijacked parts of the Internet repeatedly with no explanation.\nThis time, the BGP attack targeted the IP range used by Virtualizor, and was combined with spoofed SSL certificates for the Virtualizor servers to push spoofed updates. The BGP announcement was targeted to a specific class C: a relatively small allocation of 253 addresses, similar to what a home network would use. BGP gives precedence to the smallest announcement for an IP range, so all systems that received the spoofed announcement routed those addresses accordingly. The network advertising the false route was based in Romania, though of course they could also be a victim.\nWith control over the IP range, the attackers were able to generate a certificate via Lets Encrypt, which was sufficient for browsers and the updater to accept the rerouted addresses. The attackers then published a malicious package that appears to install additional services. The company has not provided details about the trojaned update, so it\u2019s not clear what other risks it poses.\nVirtualizor does not have a public list of customers, but one has to assume it includes high-profile companies to make such an attack viable. Hijacking BGP is extremely obvious, and isn\u2019t frequently used for such obvious spoofing attacks.\nLinux Zoom Steals Clipboard Contents\nSimon Tatham, the author of the extremely popular PuTTY SSH client among other projects, posted on Mastodon an interesting observation about the clipboard behavior of recent Zoom clients on Linux.\nRelatively recently, some operating systems have added the ability to alert the user when an application access the clipboard. Unfortunately, Linux is not yet one of them, but thanks to other clipboard management tools, Simon noticed that the recent update to Zoom 7.1.5 copies the contents of the clipboard as soon as they change. What happens to the clipboard contents once copied is currently a mystery.\nConsidering that the clipboard can often contain passwords, authentication tokens, or simply data you might not want to share with Zoom, automatically scraping the contents isn\u2019t what you\u2019d hope for.\nPlex Vulnerabilities\nThe Plex media streaming software sent out an advisory this week warning about security updates for the server and desktop application.\nDetails are currently thin, with the promise of future details once CVEs have been assigned. For now, make sure you\u2019re on version 1.43.4 or newer. The Plex post has additional directions for updating on platforms that may not have pushed new packages yet.\nAI Accelerates Exploit Development\nSecurity company CrowdStrike has released their 2026 report on threats, focusing on the proliferation of AI tools in exploit writing.\nCrowdStrike observed that 88% of exploits happened with 48 hours of the proof of concept code being released, crediting AI tools for shortening the adaptation. Typically proof of concept code is designed to demonstrate the vulnerability without providing an immediate mechanism for malicious use, and the window from exploit announcement to wide-spread risk was on the order of weeks. The report notes some vulnerabilities being widely exploited in 20 hours after public disclosure.\nThe tightening window makes patching even more important, but rapid patching caries the risk of instability when the patches themselves haven\u2019t had extensive testing. Unfortunately there\u2019s no simple solution; faster exploitation via AI tools drives faster patching, often also with AI tools that can introduce more bugs as well. \nhackaday.com/2026/09/04/this-w\u2026RE: hachyderm.io/users/simontatham\u2026", "creation_timestamp": "2026-09-04T14:37:15.827514Z"}, {"uuid": "99646243-82fb-4b12-8be9-ecbcf8291a0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74239", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/aj45fadnbtho6", "content": "CVE-2026-74239 - XenForo\nCVE ID : CVE-2026-74239\n \n Published : Sept. 8, 2026, 1:20 p.m. | 11\u00a0minutes ago\n \n Description : XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super adm...", "creation_timestamp": "2026-09-08T15:18:46.592051Z"}, {"uuid": "460e990a-0950-4cb8-9cd9-4166954018db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74239", "type": "seen", "source": "Telegram/H9pq_-_u-I5XxEZfq-Ia_chOLgi5ZnpVozN0XcBs3PyYc-g", "content": "", "creation_timestamp": "2026-09-09T04:00:31.469887Z"}, {"uuid": "028a296f-52f5-419a-b8c8-6767ad92f295", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74239", "type": "published-proof-of-concept", "source": "Telegram/H9pq_-_u-I5XxEZfq-Ia_chOLgi5ZnpVozN0XcBs3PyYc-g", "content": "", "creation_timestamp": "2026-09-10T00:00:53.313278Z"}, {"uuid": "31287f65-2b7d-4ae9-8754-254ad0988210", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74239", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mveaqw2kb22f", "content": "\ud83d\udccc CVE-2026-74239 - XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super... https://www.cyberhub.blog/cves/CVE-2026-74239", "creation_timestamp": "2026-09-12T23:37:07.464453Z"}]}