Zbtlink routers are at the center of a major cybersecurity revelation: researchers at VulnCheck have discovered that more than 20 router models from the Chinese manufacturer are shipping with a backdoor built-in straight from the factory. The malicious implant, dubbed ENDLESSDOORS , allows anyone with control over the command infrastructure to gain full root shell access to the device — without any authentication. According to the findings, CVE-2026-66747 has a severity rating of 9.3/10 and is estimated to affect over 100,000 routers worldwide.
See also: Tenda Router: Hidden backdoor in router firmware
Research by Jacob Baines, Chief Technology Officer at VulnCheck, revealed that the implant appears in 21 firmware images available on Zbtlink , spanning more than two years. This means that this is not an isolated infection or an attack that was carried out after the device was purchased — the backdoor was already present before the devices reached customers. This is a classic supply-chain attack scenario, where the supply chain is the entry point for the threat. As for Zbtlink routers,
The affected products are sold worldwide under both the Zbtlink and Wiflyer, with white-label versions available under different brands. This makes it particularly difficult to identify affected devices, as users may not be aware that their hardware comes from the same manufacturer. Reuters reported that the backdoor was previously undisclosed and could allow an attacker to gain access to devices on the same network. In relation to Zbtlink routers,
How the ENDLESSDOORS backdoor works on Zbtlink routers
At its core, ENDLESSDOORS is a small tool called rctl (remote control linux). This tool was uploaded to GitHub on January 14, 2015 and has never been modified since. It implements a simple client-server command and control mechanism: the server listens on port 7000 for connections from clients, can send individual shell commands or ask the client to open a reverse bash shell.
The implant is automatically launched at device boot time via an init.d script named skworker. To avoid detection, it disguises itself as a Linux kernel thread named kworker, while in reality it is a userland process running with root. Every approximately 35 seconds, the implant sends a “hello” message to the C2 server along with the LAN MAC address — without any handshake, negotiation, or authentication. The case of Zbtlink routers
When the server responds with the rctlbash, the implant opens a second connection on port 7001, binds a pseudo-terminal, starts /bin/sh , and creates a live interactive root shell. The communication protocol is extremely simple: "run this as root" or "give me root shell". There is no encryption — the connection is cleartext TCP — which means that anyone in the network path can intercept or tamper with the communication. Regarding Zbtlink routers,
See also: FlutterShell Backdoor Spreads on macOS via Malicious Google and YouTube Ads
C2 infrastructure and technical details of Zbtlink routers
The version of rctl found on the Zbtlink AX3000 is customized to communicate with the domain rbdg4nzqadui[.]wikaba[.]com. In addition, researchers identified other endpoints, such as zbtctl.epplink[.]net and online-string[.]com. The C2 infrastructure is hosted on Alibaba Cloud, Shanghai, which raises concerns about possible Chinese state involvement or at least exploitation by Chinese actors.
An attacker can exploit this vulnerability in two ways: either by controlling DNS resolution of the domain rbdg4nzqadui.wikaba[.]com, or by intercepting outgoing rctl via a man-in-the-middle attack. In both cases, the result is gaining complete control of the router without the attacker needing to be accessible from the internet. This makes the attack particularly dangerous, as it bypasses traditional security measures that rely on blocking incoming traffic. In the context of Zbtlink routers,
VulnCheck confirmed that every firmware listed on the zbtlink.com download page contains the rctl implant and launches it at boot. This means that there is no “safe” firmware version from the official manufacturer — at least not yet. The estimated 100,000+ affected devices worldwide make this issue one of the most serious supply-chain issues to be uncovered in the networking hardware space this year. The Zbtlink routers issue
How to protect yourself from the Zbtlink router backdoor
Organizations and users who may have affected devices should take immediate action. The first step is to list all Zbtlink and Wiflyer routers on the internal network, including white-label devices with unknown brands. Next, it is recommended to check the process list for suspicious processes that look like kworker, as well as scan the file system for files such as /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg , and /etc/init.d/skworker.
Additionally, it is critical to block outbound traffic to known C2 domains and IP addresses associated with ENDLESSDOORS. Network administrators should look for periodic outbound connections every approximately 35 seconds — this is the signature pattern of the implant. If an affected device is found, replacing or isolating it is the most reliable solution, as a factory-shipped backdoor cannot be reliably addressed with configuration changes alone.
From a network architecture perspective, it is recommended to implement network segmentation and the principle of least privilege so that a compromise of an edge router does not automatically lead to access to internal systems. Finally, organizations should contact the manufacturer and distributors to confirm the origin of the firmware, remediation timelines, and device replacement options. According to The Hacker News, VulnCheck has published a full technical analysis and indicators of compromise to help organizations identify their affected devices.
See also: Stealer Backdoor discovered in 3 versions of Node-IPC
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The Zbtlink routers is a stark example of the risks inherent in the hardware supply chain, particularly for low-cost networking devices from manufacturers with limited transparency. The fact that the backdoor remained unpublished for at least two years highlights the need for systematic firmware testing before deploying any networking device in an enterprise or mission-critical environment. The discovery of CVE-2026-66747 , with a score of 9.3 , should serve as a wake-up call for organizations using white-label networking hardware without adequate verification of its provenance.
