Backdoor Found in Multiple Router Brands
A serious security flaw has been uncovered in a range of routers produced by Shenzhen Zhibotong Electronics. These routers, sold under various brand names like Zbtlink and Wiflyer, come with a firmware implant that connects to cloud servers based in China. This connection enables remote control and manipulation of the devices by attackers.
According to 9to5Mac, the US government has taken action to address this risk. Earlier this year, it banned the import and sale of all new Chinese routers due to national security concerns. This came after discoveries last year that thousands of Asus routers were compromised by a botnet, with other brands such as Cisco, D-Link, and Linksys also being affected.
One of the main challenges with these threats is how many of these routers are made in China but sold under different brand names or claimed to be made elsewhere. Worse still, many of them are rebadged and supplied by US internet service providers, making it nearly impossible for customers to know exactly who manufactured their router or where it's from.
The ENDLESSDOORS Implant
The vulnerability, discovered by cybersecurity company VulnCheck, has been named ENDLESSDOORS. It is a malicious tool called rctl (remote control linux) that can execute commands remotely. The code was uploaded to GitHub on January 14, 2015, and has not been updated since. It functions as a command and control system, allowing the attackers to send instructions to the infected devices.
ENDLESSDOORS is especially dangerous because it allows the router to initiate communication with the command and control servers. Unlike traditional attacks that require a router to be accessible from the internet, this kind of attack does not need an open port or specific rules to be in place. Instead, the connection starts from inside the network, bypassing typical firewalls and NAT systems, making it much harder to detect and block.
This method makes it possible to control a device even if it's behind multiple layers of security, like in a hotel back office. As long as the device can access the command server, it is vulnerable regardless of its network setup or whether it has a public IP address.
How to Identify and Replace Affected Routers
To protect themselves, consumers are advised to look for specific model numbers associated with the vulnerable routers. These models include CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, and Z8102AX-2DSIM. If a user's router matches any of these models, it should be disconnected immediately and replaced to avoid potential security breaches.
The implant, which runs as root and initiates at boot via an init.d script called ‘skworker’, is remarkably chatty. It phones home to hardcoded command-and-control endpoints every 35 seconds, completely unencrypted and without a shred of authentication. Using the reserved string ‘rctlbash’, an operator can gain a live, interactive root shell on your network gateway. Zbtlink, a subsidiary of Shenzhen Zhibotong Electronics, has claimed this is merely an ‘after-sales technical support tool,’ though they have since halted sales and are scrambling to develop a firmware update.
The vulnerability has been assigned the identifier CVE-2026-66747 and is rated with a CVSS score of 9.3, reflecting the severity of the issue.