VulnCheck Finds Two Surveillance Implants in ZBT Router Firmware

🕵️ RESEARCH & DEEP DIVES

• VulnCheck Finds Two Surveillance Implants in ZBT Router Firmware
  VulnCheck found two factory surveillance implants in ZBT router firmware.
  • Affected products are ZBT/Zbtlink and white-labeled routers, including WE826-T2, WE826-Q, WE1326, WE357, WE5926, WG108, WG3526, L3_V2_8, ZBT-7628 and multiple MoreQuick and AP models.
  • SPEAKINGSTONE (CVE-2026-74232) affects builds including WE826-T2 19.1101, L3_V2_8 3.0.0.4.528, ZBT-7628 1.0.0.2.007 and MoreQuick MQAC/MQAP 1.0.0.2.000.
  • DARKLANTERN (CVE-2026-74233) runs as infosrvd on UDP 9992 and enables unauthenticated root command execution through ineffective authentication.
  • SPEAKINGSTONE runs as yunmgrd, phones home over UDP 10000, executes root commands, exfiltrates WAN PPPoE credentials, modifies DNS hijack lists and opens reverse SSH tunnels.
  • Indicators include ac-link[.]com, findmyipaddr[.]com, 47.107.224[.]89, and services or files named infosrvd, yunmgrd, inetdetect, /etc/exec/cmd and /tmp/yunclient.conf.
    📄 Source: vulncheck.com · 📎 Coverage: thehackernews.com · 👁 via r/cybersecurity

🔓 CVEs & KEV

• CVE-2026-82456 — CVSS 10.0 — argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTPargocd-mcp 0.8...

• CVE-2026-82466 — CVSS 9.4 — Rodauth before 2.46.0 Authentication Bypass via webauthn_loginRodauth before ...

• CVE-2026-82473 — CVSS 8.8 — KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoin...

• CVE-2026-82450 — CVSS 8.7 — BookStack RCE via ZIP Import Polyglot (CVE-2026-82450)

• CVE-2026-82463 — CVSS 8.6 — pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Checkp...

• CVE-2026-82461 — CVSS 8.6 — pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access T...

• CVE-2026-82474 — CVSS 8.5 — Sudo through 1.9.17p2 Intercept Policy Bypass via execveatSudo through 1.9.17...

• CVE-2026-56854 — CVSS 7.5 — Source-address critical option not enforced for non-public-key auth callbacks...

• CVE-2026-82465 — CVSS 6.9 — pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequestpac4j-s...

• CVE-2026-82462 — CVSS 6.9 — pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitutionpa...