At least 20 Zbtlink router models contain a preinstalled remote-access implant that connects to external command-and-control servers and can execute arbitrary commands with root privileges.
The issue, tracked as CVE-2026-66747, does not require attackers to compromise the router first, as the software is embedded in its firmware and starts automatically.
VulnCheck researcher Jacob Baines discovered the implant while examining a Zbtlink AX3000 Dual SIM 5G CPE WiFi 6 router, model Z8102AX-2DSIM, purchased through Alibaba. VulnCheck’s zero-day research team named the implant ENDLESSDOORS.
The researchers noticed two processes named “kworker” running as root. Legitimate Linux kernel worker threads normally appear inside brackets in process listings, but these processes were ordinary user-space programs designed to blend in with legitimate system activity.
Zbtlink is a brand operated by Shenzhen Zhibotong Electronics, a Chinese networking equipment manufacturer that sells routers under its own name and provides OEM and ODM services. Its hardware is also distributed under other brands, including Wiflyer, and through online marketplaces such as Amazon and Alibaba. This rebranding model means the number of affected products may exceed those identified by VulnCheck.
ENDLESSDOORS is based on “rctl,” a small Linux remote-control project uploaded to GitHub in 2015. The version embedded in Zbtlink firmware connects to external servers over TCP port 7000 and sends a short registration message containing a device classification string and the router’s LAN MAC address.
The protocol uses no authentication, encryption, server verification, or command restrictions. Any command returned by the server is passed to the operating system and executed as root. A special command named “rctlbash” instructs the router to open another connection and provide an interactive root shell.
Because the router initiates the connection, the device does not need to expose an internet-facing management interface. Outbound traffic can pass through NAT and standard firewall configurations, allowing the controlling server, or anyone who can intercept or redirect the connection, to take over the router.
VulnCheck demonstrated the risk by impersonating the infrastructure its test router was attempting to contact. Once the device connected, the researchers sent a command through the implant and obtained a root shell.
An examination of roughly two dozen firmware files from Zbtlink’s download site found the same implant across 20 models, including the CPE2801, WE2007, WE2008-DSIM, WG1602, WG3526, WE5927, WE5931, and Z8102AX-2DSIM. The affected firmware launches the implant at boot using an initialization script named skworker.
The routers were observed connecting to infrastructure including zbtctl.epplink[.]net, online-string[.]com, rbdg4nzqadui.wikaba[.]com, and several hardcoded IP addresses.
VulnCheck said it did not notify Zbtlink before publication because the implant appeared to be an intentionally integrated component rather than an accidental programming flaw. The researchers also reported that no trusted replacement firmware is currently available.
Organizations should identify affected devices by model number rather than branding, monitor for outbound traffic on ports 7000 and 7001, and block the published command-and-control indicators. Administrators with shell access can look for /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and /etc/init.d/skworker.
For networks carrying sensitive traffic, replacing the router is the safest option. Disabling the startup script may stop the implant, but it does not establish that the remaining firmware can be trusted.
Leave a Reply