What is CVE-2026-74232?

CVE-2026-74232 is a critical-severity vulnerability in Morequick Mqac-7620, classified under Channel Accessible by Non-Endpoint. CVSS score: 9.8/10. Published 2026-08-27.

How severe is CVE-2026-74232?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Morequick Mqac-7620

CVE-2026-74232

Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.

Published 2026-08-27 · last modified 2026-09-24.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.008 (55.8th percentile), scored 2026-10-12.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 55.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.008 · change: +0.003

Affected products

Morequick Mqac-7620 — versions 1.0.0.2.000
Morequick Mqac-7620a — versions 1.0.0.2.000
Morequick Mqap-7620 — versions 1.0.0.2.000
Morequick Mqap-7620a — versions 1.0.0.2.000
Morequick Mqap-7628 — versions 1.0.0.2.000
Zbtlink L3 V2 8 — versions 3.0.0.4.528
Zbtlink Zbt-7628 — versions 1.0.0.2.007
Zbtlink Zbt-Zbt7621 — versions 1.0.0.3.001
Ap522 — versions 1.0.0.2.014
Ap7628 — versions 3.0.0.4.380

Weakness classification (CWE)

References

vulncheck.com/blog/zbt-darklantern-speakingstone (technical-description, exploit)
www.vulncheck.com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant (third-party-advisory)

Frequently asked questions

What is CVE-2026-74232?: CVE-2026-74232 is a critical-severity vulnerability in Morequick Mqac-7620, classified under Channel Accessible by Non-Endpoint. CVSS score: 9.8/10. Published 2026-08-27.
How severe is CVE-2026-74232?: Critical severity. CVSS v3 base score is 9.8 out of 10.