CVE-2026-74232 - Zbtlink MQWrt yunmgrd Cloud C2 Implant

Back Back to CVE browser

CRITICAL

Zbtlink MQWrt yunmgrd Cloud C2 Implant

Published Aug 27, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 0.81%

Description

Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.

Affected products

Vendor MoreQuick Product MQAC-7620 Default
n/a
- Version
  1.0.0.2.000
  Status
  affected
  Constraints
  -
Vendor MoreQuick Product Mqac-7620a Default
n/a
- Version
  1.0.0.2.000
  Status
  affected
  Constraints
  -
Vendor MoreQuick Product MQAP-7620 Default
n/a
- Version
  1.0.0.2.000
  Status
  affected
  Constraints
  -
Vendor MoreQuick Product Mqap-7620a Default
n/a
- Version
  1.0.0.2.000
  Status
  affected
  Constraints
  -
Vendor MoreQuick Product MQAP-7628 Default
n/a
- Version
  1.0.0.2.000
  Status
  affected
  Constraints
  -
Vendor Zbtlink Product Zbt-Zbt7621 Default
n/a
- Version
  1.0.0.3.001
  Status
  affected
  Constraints
  -
Vendor Zbtlink Product n/a Default
n/a
- Version
  1.0.0.2.007
  Status
  affected
  Constraints
  -
- Version
  19.1101
  Status
  affected
  Constraints
  -
- Version
  3.0.0.4.528
  Status
  affected
  Constraints
  -
Vendor n/a Product APG721B Default
n/a
- Version
  19.0809
  Status
  affected
  Constraints
  -
Vendor n/a Product MAP-N10 Default
n/a
- Version
  1.0.0.2.044
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MoreQuick

MQAC-7620

n/a

Version	Status	Constraints
1.0.0.2.000	affected	-

MoreQuick

Mqac-7620a

n/a

Version	Status	Constraints
1.0.0.2.000	affected	-

MoreQuick

MQAP-7620

n/a

Version	Status	Constraints
1.0.0.2.000	affected	-

MoreQuick

Mqap-7620a

n/a

Version	Status	Constraints
1.0.0.2.000	affected	-

MoreQuick

MQAP-7628

n/a

Version	Status	Constraints
1.0.0.2.000	affected	-

Zbtlink

Zbt-Zbt7621

n/a

Version	Status	Constraints
1.0.0.3.001	affected	-

Zbtlink

n/a

Version	Status	Constraints
1.0.0.2.007	affected	-
19.1101	affected	-
3.0.0.4.528	affected	-

n/a

APG721B

n/a

Version	Status	Constraints
19.0809	affected	-

n/a

MAP-N10

n/a

Version	Status	Constraints
1.0.0.2.044	affected	-

Remediation

No remediation recorded yet.

Metrics

0.81% 0.00814

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.

EPSS probability 0.00814

Score over time

Aug-Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (2 key points)

Flat stretches are collapsed. Showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 4, 2026	0.81% (0.00814)	55.56th	v5 (v2026.06.15)
Aug 28, 2026	0.47% (0.00474)	38.98th	v5 (v2026.06.15)

Weaknesses (2)

CWE-300

CWE-506

References (2)

http://vulncheck.com/blog/zbt-darklantern-speakingstone
technical-descriptionexploit
https://www.vulncheck.com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant
third-party-advisory

Link	Providers	Tags
http://vulncheck.com/blog/zbt-darklantern-speakingstone		technical-descriptionexploit
https://www.vulncheck.com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant		third-party-advisory