ENDLESSDOORS (CVE-2026-66747); twenty Zbtlink router models ship from the factory with an unauthenticated root-command backdoor, and the discloser's remedy is replacement
The implant is not an intrusion; it is a vendor component started by the vendor's own init script
Analysis
VulnCheck published an analysis on 2026-08-05 of what it names ENDLESSDOORS, a remote-access implant pre-installed on twenty router and CPE models from Zbtlink (Shenzhen Zhibotong Electronics), including units sold under a rebranded name through mainstream e-commerce platforms (VulnCheck, 2026-08-05). The implant is a customised build of the open-source rctl remote-control tool. VulnCheck's framing is the point of the research: this is not a memory-corruption bug in a parser but a component in the vendor's product, started at boot by the vendor's own init script, shipped across twenty models (VulnCheck, 2026-08-05).
Operationally, the device registers itself outbound to hardcoded command-and-control hosts with a short unauthenticated message carrying a device-class label and the unit's MAC address, and from that point there is no handshake, no key exchange, no negotiation; whatever the server sends afterwards is handed to a shell and executed as uid 0, with a separate command spinning up an interactive reverse shell (VulnCheck, 2026-08-05). The implant hides in plain sight by taking the name of a kernel worker thread, which in a process listing sits alongside the genuine kernel threads it imitates (VulnCheck, 2026-08-05). Because control depends only on reaching the device's chosen server rather than on any credential, whoever controls that infrastructure (or anyone who takes it over) controls every unit that still calls home. VulnCheck's guidance is to segment or replace: for anything carrying real traffic it advises replacing the device, or at minimum moving it behind strict egress control and treating its LAN as untrusted, noting that disabling the init script with shell access still leaves you trusting the rest of an image that shipped the implant (VulnCheck, 2026-08-05). No vendor remedy exists to weigh against that: VulnCheck states it did not notify Zbtlink, because there is no patch to coordinate and an early warning would reach whoever operates the command infrastructure rather than the device owners (VulnCheck, 2026-08-05).
Triage: routers legitimately make outbound connections for firmware update checks, NTP and vendor telemetry, so outbound-from-CPE alone is normal. The discriminators are that this connection persists as a long-lived channel rather than completing a transaction and closing, that the traffic is command-carrying in both directions rather than a fetch, and that it targets a fixed vendor-independent host on a high port rather than a documented update endpoint on standard ports.
Cited evidence
There is no handshake, no key exchange, no negotiation.
started at boot by the vendor's own init script
The router's default firewall explicitly allows inbound connections to this port from anywhere on the internet.
Between August 18, 2026 and August 21, 2026 we’ve identified 203 internet-facing DARKLANTERN instances across 22 countries.
390 of 392 devices are in China. 83% are on China Mobile's network.
to suspend sales of affected routers and take the affected software offline while updates are being worked on (translated from German)
Updates2
VulnCheck traced the ZBT/Zbtlink supply chain further and published two additional pre-installed implants on the
same platform family (VulnCheck, 2026-08-27).
DARKLANTERN runs as the service infosrvd on UDP/9992, a port the router's default firewall explicitly opens to
the internet; an unauthenticated 19-byte probe returns the device's model, firmware, MAC address, SSID and public
IP, and a command packet passes an operator-supplied string directly to system(), where a semicolon breaks out of
the fixed command prefix into arbitrary root shell execution with no length limit or character filtering
(VulnCheck, 2026-08-27). The only gating fields are
a keyed checksum computed from a hardcoded static salt and a MAC-address check that is bypassed outright by sending
an all-zero MAC. VulnCheck's internet scanner found 203 DARKLANTERN-responsive devices across 22 countries between
18 and 21 August 2026, self-reporting across 16 different router models
(VulnCheck, 2026-08-27). SPEAKINGSTONE instead
beacons outbound over UDP/10000 to ZBT's own Alibaba Cloud infrastructure with a full device fingerprint, and
accepts plaintext, unauthenticated commands to run arbitrary shell commands, exfiltrate WAN PPPoE credentials,
write or read a DNS-hijack list, or open and close a reverse SSH tunnel; VulnCheck registered its abandoned
hardcoded backup domain and captured 392 beacons by 21 August, 390 from China, 83% on China Mobile's network, and
363 of them a single carrier-CPE model, which VulnCheck reads as a domestic Chinese surveillance deployment running
on the same firmware lineage sold to Americans through Amazon
(VulnCheck, 2026-08-27). Supply-chain tracing via
FCC filings, trademark records and archived web pages extends the confirmed OEM-rebrand list, previously US,
Canadian and Australian units (to Germany: Digineo's AC1200 Pro and ALLNET's ALL-WR1200AC-WRT) though VulnCheck is
explicit that it has not confirmed every rebrand carries the same implants
(VulnCheck, 2026-08-27). No CVE has been assigned to either new implant. The 2026-08-27 post does not restate VulnCheck's remediation
guidance or vendor-notification posture for DARKLANTERN/SPEAKINGSTONE specifically; VulnCheck's original ENDLESSDOORS
guidance, device replacement rather than a patch, and no notification to Zbtlink since there is no fix to
coordinate, remains its own position (VulnCheck, 2026-08-05).
Zbtlink has made a public statement of its own, announcing an intention "to suspend sales of affected routers and
take the affected software offline while updates are being worked on" (translated from German)
(heise, 2026-08-28). No update has
been published, and nothing in that statement covers DARKLANTERN or SPEAKINGSTONE, so device replacement and egress
control stay the operative guidance for deployed units.
Detection concept for the new implants: an unsolicited, long-lived, bidirectional command-carrying UDP channel from consumer-class CPE to a fixed external host on a non-standard port (SPEAKINGSTONE's UDP/10000 beacon), or an unauthenticated response to a 19-byte probe on UDP/9992 (DARKLANTERN), is not traffic ordinary router firmware generates, egress/ingress telemetry at the site boundary surfaces this even for an unmanaged device. Triage: routers legitimately make outbound connections for firmware checks, NTP and vendor telemetry, so outbound-from-CPE alone is not a discriminator; the tell is the fixed vendor-independent destination and the bidirectional command-carrying pattern, or an inbound-accepted session on 9992/8897 from an internet-routable source.
Zbtlink did respond publicly, and this entry said it had not. heise reports that the vendor announced an intention "to suspend sales of affected routers and take the affected software offline while updates are being worked on" (translated from German) (heise, 2026-08-28) - and that article is one this entry already cited. The 2026-08-29 update compounded it by calling VulnCheck's device-replacement guidance the only remediation position on record.
What this changes for a defender is small but real: there is a vendor engaged with the problem and a stated intent to ship firmware updates, so an asset owner has someone to press for a timeline. What it does not change is the guidance. No update has been published, the statement addresses ENDLESSDOORS and says nothing about DARKLANTERN or SPEAKINGSTONE, and a backdoor shipped in the factory image is not remediated by a sales pause. Deployed units still need replacement, or strict egress control with their LAN treated as untrusted.
Sources3
Revision history
- Published 2026-08-06T0411Z-intel
- Update 2026-08-29T0409Z-intel
VulnCheck published a follow-up on 2026-08-27 tracing the ZBT/Zbtlink supply chain further and finding two more pre-installed implants: DARKLANTERN, an unauthenticated WAN-listening command backdoor on UDP/9992 reachable by design through the router's own default firewall rules, and SPEAKINGSTONE, a phone-home implant beaconing to ZBT's own Alibaba Cloud infrastructure over UDP/10000. VulnCheck's internet scan found 203 DARKLANTERN-responsive devices across 22 countries between 18-21 August, and sinkholed SPEAKINGSTONE's abandoned backup domain to capture 392 beacons, 390 of them from China and 83% on China Mobile's network, evidence VulnCheck reads as a domestic Chinese surveillance deployment running the same firmware lineage sold to Americans through Amazon. Supply-chain tracing extends the confirmed OEM-rebrand list to Germany (Digineo AC1200 Pro, ALLNET ALL-WR1200AC-WRT) alongside existing US, Canadian and Australian rebrands, though VulnCheck is explicit that not every rebrand is confirmed to carry the same implants. No CVE has been assigned to either new implant; the follow-up post does not itself restate remediation guidance, so the original ENDLESSDOORS device-replacement guidance remains the only position on record.
Changed: entities techniques affected_products sources evidence sourcing_note body
- Correction 2026-08-30T1312Z-audit
This entry said Zbtlink "has offered nothing", and the 2026-08-29 update called VulnCheck's device-replacement guidance "the only remediation position on record". Both are wrong, and the contradicting fact was in a source this entry already cites: heise reports that Zbtlink publicly announced it would suspend sales of the affected routers and take the affected firmware offline while working on updates. The vendor's position is now stated where those claims stood. The defender guidance does not change: no update has shipped, the statement does not cover DARKLANTERN or SPEAKINGSTONE, and deployed units still need replacement or strict egress control.
Changed: summary evidence body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.