Shenzhen Zhibotong Electronics — China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access (CVE-2026-74232)

Publication date: August 28, 2026
Category: Vulnerability / Network Security

Introduction

Threat intelligence firm VulnCheck has disclosed the presence of factory-installed backdoors and implants embedded across multiple router models manufactured by Shenzhen Zhibotong Electronics (ZBT). These malicious components grant unauthenticated remote attackers the ability to execute arbitrary commands with superuser (root) privileges on affected devices. The findings expose critical supply chain risks in budget and white-label network hardware distributed globally under various commercial reseller brands.

What is SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS? (General Analysis)

The implants discovered within ZBT router firmware have been designated as SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS. These built-in control mechanisms operate as hidden services within the router’s operating system (OpenWrt-based), facilitating remote administrative access without requiring valid credentials or human interaction.

Because these components are hardcoded directly into the official firmware images supplied by the manufacturer, they represent a severe violation of software supply chain integrity. Attackers can hijack communication channels or directly interact with exposed services to compromise end-user perimeter network infrastructures.

Confirmed Vulnerability Summary (NVD)

  • CVE-2026-74232 (SPEAKINGSTONE): Command-and-control implant (yunmgrd) reachable via an unauthenticated cleartext UDP channel.
    • Official CVSS Score and Vector: 9.3 CRITICAL (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
    • Official CWE Classification: CWE-300 (Channel Accessible by Non-Endpoint), CWE-506 (Embedded Malicious Code).
  • CVE-2026-74233 (DARKLANTERN): Unauthenticated command injection in the infosrvd service (UDP port 9992).
    • Official CVSS Score and Vector: 9.3 CRITICAL (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
    • Official CWE Classification: CWE-78 (Improper Neutralization of Special Elements used in an OS Command), CWE-321 (Use of Hard-coded Cryptographic Key).
  • CVE-2026-66747 (ENDLESSDOORS): Remote-control implant built in as an OpenWrt package (librctl.so) running as root under the disguised process name kworker.
    • Official CVSS Score and Vector: 9.3 CRITICAL (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
    • Official CWE Classification: CWE-506 (Embedded Malicious Code).

How Does It Work? (Technical Analysis)

The exploitation and control mechanics embedded within these firmware builds operate across three distinct architectural vectors:

  • SPEAKINGSTONE Infection Flow (yunmgrd): The service transmits outbound beacons over UDP port 10000 to a hardcoded C2 server. By initiating outbound connections from the local network, the implant successfully bypasses standard NAT and egress filtering mechanisms. Its protocol accepts commands to execute code as root, exfiltrate PPPoE credentials, modify DNS redirect lists, and open reverse SSH tunnels.
  • DARKLANTERN Exploitation Flow (infosrvd): Operating on UDP port 9992, this service is exposed to inbound internet connections through the device’s default stock firewall. Service authentication is entirely ineffective due to a hardcoded salt and an all-zero wildcard MAC address bypass, enabling crafted UDP packets to execute arbitrary root commands.
  • ENDLESSDOORS Persistence: Embedded within the operating system to mimic legitimate Linux kernel threads ([kworker/*]), it opens no listening ports. Instead, it initiates unencrypted, unauthenticated cleartext TCP callbacks to a C2 server (channels 7000 and 7001) approximately every 35 seconds, piping any received command string directly into popen() with UID 0 privileges.

Affected Systems / Environments

The issue impacts dozens of router models built on ZBT hardware platforms and distributed globally by white-label resellers.

CVECategory (CWE)ImpactCVSSVector (summarized)
CVE-2026-74232CWE-300, CWE-506Root command execution / C29.3 (CRITICAL)AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H
CVE-2026-74233CWE-78, CWE-321Command injection / Auth bypass9.3 (CRITICAL)AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H
CVE-2026-66747CWE-506Remote-control backdoor9.3 (CRITICAL)AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H
  • Affected Models (partial sample): Zbtlink WE826-T2, WE1326, WE357, WE5926, L3_V2_8, ZBT-7628, ZBT-ZBT7621, MoreQuick MQAC-7620, AP522, HC5661A, among others.

Mitigation and Detection

Remediation

  • Perimeter Isolation: Immediately block all inbound traffic destined for UDP port 9992 at the network edge to neutralize the DARKLANTERN vector.
  • Egress Inspection: Monitor and restrict outbound UDP connections to non-standard ports like 10000, as well as recurring 35-second TCP connections to unknown external endpoints.
  • Firmware Replacement: Contact equipment vendors for clean, implant-free firmware builds or flash devices with secure open-source distributions such as vanilla OpenWrt (where hardware compatibility permits and proprietary closed dependencies are absent).

Detection

Defensive teams should actively hunt for the following Indicators of Compromise (IoCs):

  • C2 Domains: www.ac-link[.]com and www.findmyipaddr[.]com.
  • IP Addresses: 47.107.224[.]89 (Alibaba Cloud, Shenzhen).
  • Paths and Services: Processes or binaries associated with infosrvd, yunmgrd, inetdetect, alongside temporary files located at /etc/exec/cmd, /tmp/info.txt, and /tmp/yunclient.conf.
  • SHA-256 Hashes:
    • b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818 (yunmgrd)
    • 7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245 (infosrvd)
    • ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926 (inetdetect)

Analyst Note: The discovery of multiple factory-installed backdoors embedded in commercial network hardware highlights that budget router supply chains represent a systemic, invisible vector capable of bypassing traditional perimeter defenses.

Wrapping Up

The simultaneous disclosure of the SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS implants within routers manufactured by Shenzhen Zhibotong Electronics underscores the severe risks tied to acquiring low-cost network hardware lacking rigorous firmware audits. With CVSS scores of 9.3 and guaranteed unauthenticated root access, these components turn millions of devices into massive remote-control listening posts, demanding immediate perimeter filtering and strict supply chain vetting.

References