GoKawiilVulnCheck finds three hidden backdoors in ZBT-made routers sold under many brand names
Security firm VulnCheck discovered three separate backdoor-like implants embedded in firmware made by Shenzhen Zhibotong Electronics (ZBT), whose hardware is resold globally under numerous brand names. The most severe, dubbed ENDLESSDOORS, disguises itself as a Linux kernel process, phones home to a hard-coded command server without authentication or encryption, and grants attackers root-level control over the router. VulnCheck confirmed the flaw is real by hijacking a test router's command channel themselves, and identified it across 20 ZBT-based router models.
GoKawiil's interpretation of the reporting above, not reported fact.
Because ZBT builds routers for many OEM and ODM customers, the same vulnerable firmware likely ships under brands consumers wouldn't associate with a single Chinese manufacturer, making the exposure far broader than it appears at first glance. A root-level, unauthenticated remote-command implant baked into firmware at boot time gives attackers a persistent foothold into home and business networks, raising serious supply-chain security concerns for networking hardware.
- ENDLESSDOORS implant runs as root and disguises itself as a kernel process, contacting a hard-coded server with no authentication.
- The vulnerability, tracked as CVE-2026-66747, has a critical CVSS score of 9.3 and affects at least 20 ZBT router models.
- Because ZBT supplies OEM/ODM hardware globally, many rebranded routers sold under different names may be impacted.
ASUS RT-AX86S Wi-Fi 6 Router — If reading about hidden firmware implants in white-label ZBT routers makes you want to swap out your gateway, the ASUS RT-AX86S is a well-supported Wi-Fi 6 option from a vendor with a public firmware update track record and its own security suite. It covers a whole home with plenty of wired ports for desktops and consoles, and you can keep it patched yourself instead of trusting an unbranded box.
See ASUS RT-AX86S Wi-Fi 6 Router on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Zak Killian, 2026-08-28
Published there as: “Security researchers find surveillance implants in Chinese-made routers sold worldwide — three different backdoor-like implants hidden in firmware”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.