Full Report
It’s just a remote maintenance function, says Zbtlink
Analysis Summary
# Vulnerability: ENDLESSDOORS Remote Access Implant in Zbtlink Firmware
## CVE Details
- **CVE ID**: Not yet assigned (Discovered/Reported August 2024)
- **CVSS Score**: Estimated 9.8 - 10.0 (Critical)
- **CWE**: CWE-1021 (Improper Restriction of Rendered UI Layers) / CWE-912 (Managed Backdoor)
## Affected Systems
- **Products**: Zbtlink, ZBT, ZBTWiFi, and Wiflyer routers.
- **Versions**: Firmware for over 20 router models (Specific versions currently being identified/removed by vendor).
- **Configurations**: Default factory firmware; specifically units shipped with the "rctl" (remote control linux) binary.
## Vulnerability Description
Security researchers identified a built-in backdoor dubbed **ENDLESSDOORS**. The flaw consists of an obscure tool called `rctl` (Remote Control Linux) that is initialized at boot via vendor init scripts.
Technically, the implant runs as a root-level userland process disguised with a name intended to blend in with legitimate Linux kernel threads. It functions as a "phone-home" trojan, reaching out to hardcoded command-and-control (C2) servers on port 7000. The protocol lacks handshake, encryption, or authentication; it sends a 39-byte "hello" packet containing the device's MAC address and waits for shell commands or a request to spawn a reverse bash shell.
## Exploitation
- **Status**: Pre-installed by vendor; Public PoC/Technical breakdown available.
- **Complexity**: Low (No authentication or key exchange required).
- **Attack Vector**: Network (Remote via hijacked C2 infrastructure or Man-in-the-Middle).
## Impact
- **Confidentiality**: Total (Remote shell access allows full data interception).
- **Integrity**: Total (Attacker can modify firmware, settings, and traffic).
- **Availability**: Total (Attacker can brick the device or disable networking).
## Remediation
### Patches
- **Status**: Pending. Zbtlink has temporarily removed affected firmware from its official download pages and is currently developing "secured patched firmware."
### Workarounds
- **Egress Filtering**: Block all outbound traffic to the following endpoints:
- `rbdg4nzqadui[.]wikaba[.]com`
- **Device Replacement**: Replace affected hardware with devices from vendors that do not include remote maintenance implants.
- **Alternative Firmware**: If hardware is compatible, flash with clean, community-verified OpenWrt builds (though this may void warranties).
## Detection
- **Network Indicators**: Monitor for outbound connections on **TCP Port 7000**.
- **Process Monitoring**: Look for suspicious Linux kernel threads with real memory footprints that behave like userland processes.
- **Signatures**: Use Suricata, Snort, or YARA rules provided by VulnCheck to scan for the `rctl` binary or its network "hello" packet (a 33-byte class label padded with nulls followed by a LAN MAC address).
## References
- **VulnCheck Blog**: hxxps[://]vulncheck[.]com/blog/zbt-endlessdoors
- **Vendor Site**: hxxps[://]www[.]zbtlink[.]com/
- **Source Code of Implant**: hxxps[://]github[.]com/ycsunjane/rctl