47.107.224.89

VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices. The implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233. VulnCheck, which assigned both identifiers as a CVE Numbering Authority (CNA), rated each 9.3 on the CVSS 4.0 scoring system and 9.8 on CVSS 3.1. Both vectors record a network attack requiring no privileges and no user interaction. SPEAKINGSTONE, which runs as the service yunmgrd, sends beacons over UDP port 10000 to a hardcoded command-and-control (C2) server. Because the implant dials outward, it functions from behind NAT and ordinary egress filtering. Its protocol supports message types that execute arbitrary commands as root, exfiltrate the WAN PPPoE username and password, write and read a DNS hijack list, and open a reverse SSH tunnel. "This is a surveillance implant with root access to every device it runs on," VulnCheck said in its supply chain research. DARKLANTERN operates as the service infosrvd on UDP port 9992, which the router's stock firewall opens to inbound connections from any internet address. VulnCheck's advisory describes the service's authentication as ineffective, resting on a hardcoded salt and an all-zero wildcard MAC value that bypasses its own address check. Between August 18 and August 21, VulnCheck identified 203 internet-facing DARKLANTERN instances across 22 countries, self-reporting 16 distinct models. The figure counts hosts that answered a probe rather than devices found compromised. Both implants were found on an $88 Deep Orange 3G/4G/LTE Router bought from a U.S. supplier, a white-labeled ZBT-WE826-T2 whose firmware was built in 2019. That unit predates ENDLESSDOORS (CVE-2026-66747), the phone-home implant VulnCheck disclosed on August 5 and found in at least 20 Zbtlink router models. VulnCheck's advisory for the DARKLANTERN command injection and its advisory for the SPEAKINGSTONE C2 implant name the following models and firmware builds - CVE-2026-74233 (DARKLANTERN) - Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108 and WG3526 on firmware 19.1101, WE2426-C on 19.1112, WE5926-EC_QP on 20.0516 and WF3526-P on 19.051, plus CTN720-W1, LF-1541 and MT7620N on 19.1101 and WRC1 on 20.0622, which the CVE record lists under an unidentified vendor. CVE-2026-74232 (SPEAKINGSTONE) - Zbtlink L3_V2_8 on 3.0.0.4.528, WE826-T2 on 19.1101, ZBT-7628 on 1.0.0.2.007 and ZBT-ZBT7621 on 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A and MQAP-7628 on 1.0.0.2.000, and AP522 on 1.0.0.2.014, AP7628 and HC5661A on 3.0.0.4.380, APG721B on 19.0809, HK300 on 1.0.0.2.032 and MAP-N10 on 1.0.0.2.044 under an unidentified vendor. The advisory pages display those builds as upper bounds, while the CVE records name each firmware as a single exact build and set the default status of every other version to unknown. Neither advisory names a fixed firmware release, leaving an owner on a build outside the listed set without a published basis for deciding whether the flaw applies. Model number rather than brand is the reliable check, because ZBT sells the same hardware and firmware to resellers that put their own name on the case. The Hacker News confirmed via the IEEE-registered MAC prefix database on August 28 that the blocks 78:A3:51 and F8:5E:3C are both assigned to Shenzhen Zhibotong Electronics, letting an owner identify the manufacturer from the device's own address. SPEAKINGSTONE carries a hardcoded backup C2 domain that the implant reaches for where a primary server was never configured, and VulnCheck found that domain unregistered. The company registered the domain and stood up a server running a reverse-engineered implementation of the protocol. Beacons began arriving as soon as the server was live. As of August 21, 392 unique devices had reported in, of which 390 were in China. VulnCheck said 83 percent were on China Mobile's network, that 304 of the 392 broadcast SSIDs beginning with "CMCC", and that 363 self-reported a single model, L3_V2_8, running firmware 3.0.0.4.528. Because a device reaches the backup domain only where a primary C2 was never configured, the 392 are a floor drawn from an unrepresentative subset rather than a count of affected devices. VulnCheck flags CVE-2026-74233 in its own Known Exploited Vulnerabilities catalog, whose published criteria require that a vulnerability be "publicly-reported as exploited in the wild." CISA's Vulnrichment enrichment, recorded against the same CVE on August 27, rates exploitation as proof of concept, which the agency's documentation defines as a public proof-of-concept existing at the time of analysis. The Hacker News confirmed via CISA's Known Exploited Vulnerabilities catalog, version 2026.08.27, that none of the three ZBT CVEs appear in it as of August 28. VulnCheck published the following indicators of compromise (IoCs) - Domains - www.ac-link[.]com , the SPEAKINGSTONE primary C2, andwww.findmyipaddr[.]com , the backup domain VulnCheck registered IP address - 47.107.224[.]89 , an Alibaba Cloud address in Shenzhen that the primary C2 domain still resolved to when The Hacker News checked on August 28 Ports - UDP/9992 inbound for DARKLANTERN, UDP/8897 for its responses, and UDP/10000 outbound for SPEAKINGSTONE beacons Services and paths - infosrvd ,yunmgrd ,inetdetect ,/etc/exec/cmd ,/tmp/info.txt and/tmp/yunclient.conf SHA-256 hashes - b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818 (yunmgrd),7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245 (infosrvd) andae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926 (inetdetect) VulnCheck's guidance for the earlier implant was to block and alert on the endpoints at both the egress and the resolver, and to treat the router's LAN as untrusted. Because DARKLANTERN listens on UDP/9992, blocking inbound traffic to that port at the network edge closes off the listener while a fixed release is outstanding. VulnCheck published Suricata and YARA rules alongside the research, one of which alerts on DARKLANTERN command output arriving on UDP port 8898 while the accompanying text and scanner both use 8897. Zbtlink addressed the earlier ENDLESSDOORS component in a statement on its website, saying it serves solely as an after-sales technical support tool used only on a customer's explicit request and authorization. "This component has never been used for unauthorized access," the company said. A Zbtlink spokesperson told The Hacker News on August 6 that the feature is "solely intended" for after-sales maintenance and serves no other purposes. "It is generally retained only on sample units to assist customers with software debugging," the spokesperson added. That statement addresses ENDLESSDOORS alone, and Zbtlink has issued no public statement on yunmgrd or infosrvd. The Hacker News found on August 28 that the company's firmware download pages were live and serving eight images dated August 17, among them builds for the WE826-T2 and WE2426-C, both named in the new advisories. VulnCheck said the implants ship with ZBT firmware, and pointed to MOFI Network, which develops its own firmware for the same platform and whose examined image was free of the three implants. The Hacker News has reached out to Zbtlink for comment on whether its current firmware still contains the two components, and to VulnCheck for the evidence behind its catalog listing, and will update this story with any response.

Cybersecurity researchers have disclosed details of a "factory-shipped backdoor" implanted in at least 20 Chinese router models from Zbtlink. According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years. The backdoors are designed such that they start automatically and attempt to beacon to Chinese command-and-control (C2) infrastructure as often as every 35 seconds. They masquerade as a Linux kernel thread, but are actually userland processes running with root privileges while blending their true functionality with other legitimate kworker processes. The "phone home" implants have been codenamed ENDLESSDOORS. "ENDLESSDOORS, at its core, is a small tool called rctl (remote control linux)," Jacob Baines, VulnCheck Chief Technology Officer, said. "Uploaded to GitHub on January 14, 2015 and never touched again, this obscure repository implements a simple command and control client and server." "The server listens on port 7000 for clients to connect. It can send the client individual shell commands or tell the client to spawn a reverse bash shell." The "kworker" worker process running on Zbtlink AX3000, which VulnCheck analyzed, is a customized version of rctl that's configured to contact the following - 47.107.224[.]89 rbdg4nzqadui[.]wikaba[.]com What's more, there is no handshake, negotiation, or authentication involved. Once the implant sends a "hello" message to the server alongside the LAN MAC address, it's engineered to run whatever the server sends back in response. "One reserved string, rctlbash, tells the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it," Baines explained. "That is a live interactive root shell." "The vocabulary of this protocol is two phrases: run this as root, and give me a root shell. Anyone along the network path can hijack the client/server communication. Anyone who controls the resolution of rbdg4nzqadui.wikaba[.]com, or the address it resolves to, can control any ENDLESSDOORS implant that tries to phone home." An attacker can take advantage of this loophole to hijack the outbound rctl communications and obtain a live root shell, and take over control of the router without having to be reachable from the internet. VulnCheck noted that every firmware listed on zbtlink.com's download page embeds the rctl implant and starts it at boot with an init.d script named "skworker." The list of affected models is below - CPE2801 WE1026-5G-WD WE1326 WE2007 WE2008-DSIM WE2416 WE3326 WE5927 WE5931 WE5931AC WE826-T3-DSIM WG108 WG1602 WG1608-DSIM WG209 WG2105 WG2107 WG259 WG3526 Z8102AX-2DSIM Each of these models have been found to have been found to dial the same set of four primary and secondary endpoints - zbtctl.epplink[.]net (47.100.190[.]96) 47.107.224[.]89 online-string[.]com (45.32.81[.]152) rbdg4nzqadui.wikaba[.]com (43.248.136[.]125) As of writing, users visiting the firmware downloads page on Zbtlink's website are displayed the below message - We have detected firmware security vulnerabilities affecting selected router firmware releases. As a precautionary measure, the impacted firmware versions have been temporarily taken down from download channels. Our engineering team is working intensively to develop and validate secured patched firmware. We will notify you immediately once the fixed, security-validated firmware is available for release. We apologize for the inconvenience caused. Thank you for your understanding. When contacted for comment, a spokesperson for the Chinese router manufacturer told The Hacker News that the feature is "solely intended" for after-sales maintenance and serves no other purposes. "It is generally retained only on sample units to assist customers with software debugging," the spokesperson added. "Our company specializes in OEM and ODM customization services." "Our customers use their own self-developed software instead of ZBT's default firmware. Customer security and privacy are our top priority. We take this report very seriously and are working to expedite the implementation of a solution." In the meantime, customers are advised to check the process list, scan the file system for files like /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and /etc/init.d/skworker, and block the egress points. Update In an updated statement posted on its website, Zbtlink reiterated that the "remote management component" is used only for after-sales technical support and to "assist customers with device troubleshooting and configuration only upon their explicit request and authorization." The company also said it has never been used for unauthorized access. In connection with the discovery, Zbtlink said it's immediately suspending the sale of the affected models and that it has removed the relevant firmware from the site. "We are currently developing and releasing firmware updates to fully resolve the issue with the rctl component," it added. (The story was updated after publication to include a response from Zbtlink.)