Full Report
Cybersecurity researchers have disclosed details of a "factory-shipped backdoor" implanted in at least 20 Chinese router models from Zbtlink. According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years. The backdoors are designed such that they start automatically and attempt to beacon to Chinese
Analysis Summary
# Vulnerability: ENDLESSDOORS Factory-Shipped Backdoor in Zbtlink Routers
## CVE Details
- **CVE ID**: Not explicitly assigned in the provided report (Referred to as "ENDLESSDOORS" by VulnCheck).
- **CVSS Score**: Estimated 10.0 (Critical) based on unauthenticated remote root access.
- **CWE**: CWE-912: Managed Post-Partition Website (Hidden Backdoor), CWE-78: OS Command Injection.
## Affected Systems
- **Products**: Zbtlink Routers (various models).
- **Versions**: All 21 firmware images currently available from Zbtlink (spanning over 2 years of releases).
- **Configurations**: Default factory settings; the implant starts automatically at boot via `init.d`.
- **List of Affected Models**:
CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, Z8102AX-2DSIM.
## Vulnerability Description
The vulnerability consists of a "factory-shipped backdoor" known as **ENDLESSDOORS**, which utilizes a customized version of an obscure tool called `rctl` (Remote Control Linux). The implant masquerades as a legitimate Linux kernel thread (`kworker`) but operates as a userland process with root privileges.
Upon boot, the script `/etc/init.d/skworker` executes the binary, which beacons to hardcoded C2 (Command and Control) infrastructure every 35 seconds. The protocol lacks any authentication or encryption. When the implant receives the string `rctlbash`, it spawns an interactive reverse shell (`/bin/sh`) on port 7001, providing the remote server with full root access to the device.
## Exploitation
- **Status**: Exploited in the wild (Functioning as a pre-installed backdoor).
- **Complexity**: Low (The protocol has no handshake or authentication).
- **Attack Vector**: Network (The device beacons out to the internet, allowing control from any actor capable of intercepting or spoofing the C2 infrastructure).
## Impact
- **Confidentiality**: Total (Full access to traffic and device data).
- **Integrity**: Total (Remote root shell allows modification of any system file or firmware).
- **Availability**: Total (Attacker can disable the device or change configurations).
## Remediation
### Patches
- **Status**: Pending. Zbtlink has temporarily removed the impacted firmware versions from their official download channels and is reportedly working on validated patches.
### Workarounds
- **Egress Filtering**: Block all outbound traffic to the known C2 endpoints listed below.
- **Manual Removal**: If users have terminal access, they can attempt to disable the `skworker` init script and kill the associated `kworker` processes, though this may be overwritten by system updates or persistence mechanisms.
## Detection
### Indicators of Compromise (IoC)
**Files:**
- `/usr/sbin/kworker`
- `/usr/lib/librctl.so`
- `/etc/kworker.cfg`
- `/etc/init.d/skworker`
**Network Endpoints:**
- `zbtctl.epplink[.]net` (47.100.190[.]96)
- `47.107.224[.]89`
- `online-string[.]com` (45.32.81[.]152)
- `rbdg4nzqadui.wikaba[.]com` (43.248.136[.]125)
### Detection Methods
- **Process Analysis**: Check the process list for `kworker` instances that are not actual kernel threads (typically those running with high PIDs or appearing in userland).
- **Traffic Monitoring**: Monitor for outbound connections on ports 7000 and 7001.
## References
- **VulnCheck Report**: hxxps[://]www[.]vulncheck[.]com/blog/zbt-endlessdoors
- **Vendor Download Page**: hxxps[://]www[.]zbtlink[.]com/pages/zbt-router-firmware-download
- **Source Article**: hxxps[://]thehackernews[.]com/2026/08/chinese-made-zbtlink-routers-ship-with.html