Description
Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Zbtlink L3_V2_8
Default version status: unknown
3.0.0.4.528affected
Zbtlink WE826-T2
Default version status: unknown
19.1101affected
Zbtlink ZBT-7628
Default version status: unknown
1.0.0.2.007affected
Zbtlink ZBT-ZBT7621
Default version status: unknown
1.0.0.3.001affected
MoreQuick MQAC-7620
Default version status: unknown
1.0.0.2.000affected
MoreQuick MQAC-7620A
Default version status: unknown
1.0.0.2.000affected
MoreQuick MQAP-7620
Default version status: unknown
1.0.0.2.000affected
MoreQuick MQAP-7620A
Default version status: unknown
1.0.0.2.000affected
MoreQuick MQAP-7628
Default version status: unknown
1.0.0.2.000affected
Unknown AP522
Default version status: unknown
1.0.0.2.014affected
Unknown AP7628
Default version status: unknown
3.0.0.4.380affected
Unknown APG721B
Default version status: unknown
19.0809affected
Unknown HC5661A
Default version status: unknown
3.0.0.4.380affected
Unknown HK300
Default version status: unknown
1.0.0.2.032affected
Unknown MAP-N10
Default version status: unknown
1.0.0.2.044affected