A critical unauthenticated command injection vulnerability in Zbtlink router firmware allows remote attackers to execute arbitrary code as root, posing a severe risk of full device compromise.

The flaw exists in the infosrvd service (UDP/9992) where hardcoded cryptographic keys and a wildcard MAC bypass mechanism fail to authenticate remote requests, enabling unauthenticated OS command injection.

Successful exploitation grants a remote, unauthenticated attacker complete control over the affected hardware with root-level privileges. This enables total system compromise, including the ability to intercept network traffic, pivot into internal environments, or deploy persistent malware, justifying the 9.8 CVSS critical severity score.

Immediate Action: Identify all exposed Zbtlink devices and isolate them from the public internet immediately, as no patch availability is confirmed for these legacy models.

Proactive Monitoring: Monitor network traffic for unusual UDP activity on port 9992 and inspect device logs for unexpected command execution or configuration changes.

Compensating Controls: Implement strict firewall rules to block all inbound traffic to UDP port 9992 from untrusted networks until firmware updates are applied or devices are retired.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the VulnCheck technical write-up.

Given the critical nature of this vulnerability and the ease of exploitation, organizations must treat affected Zbtlink routers as compromised if exposed to the internet. Immediate isolation or replacement of these devices is required to prevent unauthorized access and potential lateral movement within the network.