Router firmware backdoors have been uncovered in networking hardware built by Shenzhen Zhibotong Electronics, commonly known as ZBT. Security firm VulnCheck identified three separate implants hidden inside the firmware of these devices, which are distributed globally under numerous brand names. Because ZBT manufactures routers for OEM and ODM partners, many users may be operating a ZBT device without knowing it.
The investigation started with a Zbtlink AX3000 router. Researchers discovered an implant they named ENDLESSDOORS, which automatically contacts a command-and-control server and can run arbitrary commands with root privileges. The implant launches at boot and hides itself as a routine Linux kernel process called kworker. The router repeatedly connects to a hard-coded server to announce its presence, with no meaningful authentication or encryption in place. Commands from the server pass directly to a shell running as root, and the implant can also open an interactive root shell.
To prove the risk, VulnCheck impersonated the command server and seized control of its own test router. That demonstrates the flaw is not theoretical: any attacker able to hijack the connection to the command server can take full control of the device. ENDLESSDOORS was found in firmware across 20 ZBT models, including the Z8102AX, WG3526, WE826-T3-DSIM, and several cellular routers. The issue was assigned CVE-2026-66747 with a CVSS score of 9.3.
A Rebranded Router From Amazon Revealed Two More Implants
VulnCheck then purchased an EUR 76 Deep Orange cellular router from a US Amazon seller and found it was a white-labeled ZBT-WE826-T2. Its 2019 firmware predated ENDLESSDOORS, but it carried two other implants instead, named DARKLANTERN and SPEAKINGSTONE.
DARKLANTERN is the most direct of the three. Running as the infosrvd service, it opens a listener on the WAN through UDP port 9992 and accepts commands straight from the internet without authentication. An attacker only needs to send a fixed 19-byte info probe to make the router disclose identifying details such as its model, firmware version, MAC address, and uptime.
Weak Safeguards Allow Remote Root Access
Researchers found the backdoor’s limited protections easy to defeat. Its command payload checksum depends on a static, hard-coded salt (“mqonu.com”), and its internal MAC address filter can be bypassed simply by submitting a MAC field of all zeroes. This lets a remote attacker forge a packet and execute arbitrary commands as root. When VulnCheck scanned the internet, it located 203 exposed DARKLANTERN instances across 22 countries and 16 different router models.
The label on the Deep Orange 4G/LTE router that VulnCheck bought from the US Amazon seller identifies it as a rebranded ZBT device. VulnCheck’s analysis mapped the surveillance architecture behind both DARKLANTERN and SPEAKINGSTONE, confirming that the affected hardware reaches customers through a wide range of brand names worldwide.
Source
Image: tomshardware.com
