GoKawiilSecurity researchers have found three different backdoor-like implants hidden in firmware for routers manufactured by Shenzhen Zhibotong Electronics, better known as ZBT. The hardware is sold around the world under a bewildering array of brands, meaning you may not even realize you're using a ZBT router. The research, published by security firm VulnCheck, began with a Zbtlink AX3000 router. Researchers found that its firmware contained an implant that they dubbed ENDLESSDOORS, as it automatically phones home to a command-and-control server and can execute arbitrary commands as root.
ENDLESSDOORS is essentially a remote-control system embedded directly into the router's firmware. It starts automatically at boot and disguises itself as a normal Linux kernel process called kworker. The router periodically connects to a hard-coded server and announces itself. There's no meaningful authentication or encryption involved. Commands received from the server are passed directly to a shell running as root, and the implant can also establish an interactive root shell.
VulnCheck demonstrated the problem by impersonating the command server and taking control of its own test router. In other words, this isn't merely a theoretical vulnerability; if an attacker can hijack the connection to the implant's command server, they can obtain complete control of the router. The researchers found ENDLESSDOORS embedded in firmware for 20 ZBT models, including the Z8102AX, WG3526, WE826-T3-DSIM, and several other cellular routers. The same hardware is also sold under other names because ZBT manufactures routers for OEM and ODM customers. VulnCheck assigned the issue CVE-2026-66747, with a CVSS score of 9.3, but that wasn't the end of the investigation.
Latest Videos From Tom's Hardware Watch full video here:
The label on the Deep Orange 4G/LTE Router that VulnCheck purchased from a US Amazon seller clearly marks its as a rebranded ZBT device. (Image credit: VulnCheck)
VulnCheck subsequently bought an $88 Deep Orange cellular router from a US seller on Amazon and discovered that it was actually a white-labeled ZBT-WE826-T2. Its 2019 firmware was too old to contain ENDLESSDOORS, but instead, it contained two other implants that the firm designated DARKLANTERN and SPEAKINGSTONE.
DARKLANTERN is the particularly straightforward one. Operating as the infosrvd service, it opens a listener on the WAN via UDP port 9992 and accepts commands directly from the Internet without authentication. An attacker only needs to send a fixed 19-byte info probe to force the router to reveal identifying information like its model, firmware version, MAC address, and uptime.
Researchers found that the backdoor's meager security mechanisms could be trivially bypassed: its command payload checksum relies on a static, hardcoded salt ("mqonu.com"), and its internal MAC address filter can be entirely circumvented simply by submitting a MAC field of all zeroes. This allows any remote attacker to easily forge a packet and execute arbitrary commands as root. VulnCheck scanned the Internet and found 203 exposed DARKLANTERN instances in 22 countries, spread across 16 router models.
This diagram shows the surveillance architecture of the DARKLANTERN and SPEAKINGSTONE vulnerabilities. (Image credit: Vulncheck)
Meanwhile, SPEAKINGSTONE works differently and is even more concerning. Rather than waiting for an attacker to connect to a listening port, it runs as the yunmgrd service and periodically beacons outbound to ZBT's command-and-control infrastructure over UDP port 10000. That makes it useful even when the router sits securely behind NAT or a firewall, as it relies on a custom format dubbed "zbtProtocol" to push full device fingerprints directly to the remote server. SPEAKINGSTONE is also considerably more capable than simply providing a remote shell. According to VulnCheck, its command protocol allows remote operators to execute arbitrary commands, steal WAN PPPoE credentials, rewrite a DNS hijack list, and establish a reverse SSH tunnel.
... continue reading