[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

2 clusters · 15 sources · 5 days · First seen · Last updated

Zbtlink router ENDLESSDOORS backdoor discovery

Overview

Security researchers at VulnCheck identified a malicious implant named ‘ENDLESSDOORS’ embedded in router models manufactured by Shenzhen-based Zbtlink Electronics (also known as Shenzhen Zhibotong Electronics). The vulnerability, discovered in devices such as the Zbtlink AX3000 Dual SIM 5G CPE WiFi 6 router, allows for unauthorized remote Linux control with root privileges.

The implant functions by using a modified ‘rctl’ tool to act as both a client and server, hiding among processes named ‘kworker’. Because the device initiates outbound connections, it can bypass firewalls and NAT settings. In one instance, the device made unauthorized connections even while on an isolated research network.

Zbtlink has suspended sales of affected models and is developing patches, claiming the code was intended as an “after-sales technical-support tool,” though researchers argue it was deliberately hidden. Analysts estimate at least 100,000 routers are deployed worldwide. The discovery has prompted security advisories from the Canadian government and drawn attention to existing U.S. FCC restrictions on Chinese consumer routers.

Entities

Federal Communications Commission · Endlessdoors · TP‑Link · Shenzhen Zhibotong Electronics · TP-Link

Timeline

  1. 1 day ago

    [TECHNOLOGY] 2 sources
    Zbtlink routers found with embedded spyware component

    Researchers discovered ‘ENDLESSDOORS’, a malicious component in Zbtlink and Wiflyer routers that allows remote root access via unauthorized outbound connections to external servers.

  2. 6 days ago

    [TECHNOLOGY] 13 sources
    Zbtlink routers harbor factory-installed ENDLESSDOORS backdoor

    Zbtlink routers (≥20 models, CVE‑2026‑66747) contain a factory‑installed ENDLESSDOORS backdoor that gives root access, contacts a China‑registered domain every 35 seconds, and affects an estimated 100,000 units

Sources

au.pcmag.com · cyberinsider.com · finance.technews.tw · flagthis.com · forkast.news · gulf-insider.com · news.hkheadline.com.hk · securityaffairs.co · sf-encyclopedia.com · sketcher.startitup.sk · sofx.com · startitup.sk · techritual.com · unwire.hk · wtvbam.com