Full Report
VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices. The implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.
Analysis Summary
# Vulnerability: Undocumented Factory Implants in ZBT Routers
## CVE Details
* **CVE ID:** CVE-2026-74232 (SPEAKINGSTONE) and CVE-2026-74233 (DARKLANTERN)
* **CVSS Score:** 9.3 (CVSS 4.0) / 9.8 (CVSS 3.1) (Critical)
* **CWE:** Command Injection / Ineffective Authentication (Implant-based backdoors)
## Affected Systems
* **Products:** Routers built by Shenzhen Zhibotong Electronics (ZBT), including white-labeled units sold under brands like Zbtlink, MoreQuick, and Deep Orange.
* **Versions:**
* **CVE-2026-74233:** Zbtlink WE1326, WE357, WE5926, WE826 series, WG108, WG3526 (Firmware 19.1101); WE2426-C (19.1112); WE5926-EC_QP (20.0516); WF3526-P (19.051).
* **CVE-2026-74232:** Zbtlink L3_V2_8 (3.0.0.4.528), WE826-T2 (19.1101), ZBT-7628 (1.0.0.2.007); MoreQuick MQAC/MQAP series (1.0.0.2.000); AP522, AP7628, HC5661A, HK300, MAP-N10.
* **Configurations:** Stock factory firmware. Device identity can be verified via MAC prefixes `78:A3:51` and `F8:5E:3C`.
## Vulnerability Description
Research has identified two persistent factory-installed implants:
* **SPEAKINGSTONE (yunmgrd):** A surveillance implant that beacons via UDP port 10000 to a C2 server. It can bypass NAT/egress filtering, execute root commands, exfiltrate PPPoE credentials, hijack DNS, and establish reverse SSH tunnels.
* **DARKLANTERN (infosrvd):** A service listening on UDP port 9992. The stock firewall leaves this port open to the internet. Authentication is bypassed via a hardcoded salt and a wildcard MAC address (all zeros), allowing remote command injection.
## Exploitation
* **Status:** PoC available (reverse-engineered by researchers); evidence of hundreds of active beacons worldwide (primarily in China).
* **Complexity:** Low
* **Attack Vector:** Network (Unauthenticated)
## Impact
* **Confidentiality:** Total (Full access to traffic, credentials, and DNS)
* **Integrity:** Total (Root-level command execution)
* **Availability:** Total (Ability to modify or disable device functionality)
## Remediation
### Patches
* **None Available:** As of the disclosure, the vendor has not released fixed firmware versions. The listed vulnerable builds are considered the "upper bounds" of known affected versions.
### Workarounds
* **Egress Filtering:** Block outbound UDP traffic on port 10000 to disrupt SPEAKINGSTONE C2 communication.
* **Firewall Inbound:** Ensure UDP port 9992 is strictly blocked from the WAN side to mitigate DARKLANTERN.
* **Firmware Replacement:** Users are often advised to switch to trusted open-source firmware (e.g., OpenWrt) if the hardware supports it, given the supply-chain nature of these flaws.
## Detection
* **Indicators of Compromise:**
* Active processes named `yunmgrd` or `infosrvd`.
* Outbound traffic to unregistered or suspicious hardcoded C2 domains on UDP 10000.
* Listening service on UDP port 9992 open to WAN.
* **Detection methods:** Scan internal and external interfaces for ports 9992 and 10000. Verify manufacturer via MAC address prefix lookup.
## References
* VulnCheck Supply Chain Research: hxxps[://]www[.]vulncheck[.]com/blog/zbt-darklantern-speakingstone
* DARKLANTERN Advisory: hxxps[://]www[.]vulncheck[.]com/advisories/zbtlink-mqwrt-infosrvd-command-injection
* SPEAKINGSTONE Advisory: hxxps[://]www[.]vulncheck[.]com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant