Deviceways

Router

ZBT WG3526

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
16M · 16 MB flash
Flash: 16 MBGet OpenWrt firmware Release listed · 25.12.6Open device guide Release listed · 25.12.5
32M · 32 MB flash
Flash: 32 MBGet OpenWrt firmware Release listed · 25.12.6Open device guide Release listed · 25.12.5
16M; (16M)
Open hardware record
32M; (32M)
Open hardware record
Original project github.com
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

zbt wg3526 16m — device documentation (github.com)

Hardware revision
16M

Device details

zbt wg3526 32m — device documentation (github.com)

Hardware revision
32M

Device details

ZBT WG3526 (16M) — TechInfoDepot (github.com)

Hardware revision
(16M)

Device details

ZBT WG3526 (32M) — TechInfoDepot (github.com)

Hardware revision
(32M)

Device details

Device details — Source documentation (openwrt.org)

Hardware revision
16M

OpenWrt · 16M · 16 MB flash

OpenWrt · 16M · 16 MB flash — Source documentation (openwrt.org)

Recovery routes recorded
U-Boot web recovery
Availability recorded by source
Available 2024

Device details

Device details — Source documentation (openwrt.org)

Hardware revision
32M

OpenWrt · 32M · 32 MB flash

OpenWrt · 32M · 32 MB flash — Source documentation (openwrt.org)

Availability recorded by source
Available 2024

Hardware differences

Technical references

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 9.3 (v4.0)

WG3526

Zbtlink MQWrt infosrvd Command Injection

CVE-2026-74233

Affected firmware
19.1101
Fix
Fix details in the linked record
Read VulnCheck CVE record
Details and sources
Public disclosure CVE updated

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.

Security advisory zbtlink mqwrt infosrvd command injection — WG3526 (vulncheck.com) ↗
Check more security advisories for this device · CVE.org