The Hacker News30%
Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells 20%
By Ravie Lakshmanan22%
8/6/2026, 1:05:00 AM
Keywords: Zbtlink Routers, Backdoor, Endlessdoors, Rctl, Root Shell, Cybersecurity, Iot Security, Firmware Vulnerability
BS Summary: This article contains 22 faulty reasoning types, including Optimism Bias, Hasty Generalization, and Negativity Bias, with Unattributed Quote as the most egregious example at 24.9% saturation with 166 hits. Analysis detected 748 faulty-reasoning hits from 666 analyzed words, generating a BS Score of 26.8% and a BS Rank of 20% (24,748 of 30,584 articles). This article is better (less manipulative) than 80.90% of the article peer group.
Cybersecurity researchers have disclosed details of a "factory-shipped backdoor" implanted in at least 20 Chinese router models from Zbtlink.
According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years.
The backdoors are designed such that they start automatically and attempt to beacon to Chinese command-and-control (C2) infrastructure as often as every 35 seconds.
They masquerade as a Linux kernel thread, but are actually userland processes running with root privileges while blending their true functionality with other legitimate kworker processes.
The "phone home" implants have been codenamed ENDLESSDOORS.
"ENDLESSDOORS, at its core, is a small tool called rctl (remote control linux)," Jacob Baines, VulnCheck Chief Technology Officer, said.
"Uploaded to GitHub on January 14, 2015 and never touched again, this obscure repository implements a simple command and control client and server."
"The server listens on port 7000 for clients to connect.
It can send the client individual shell commands or tell the client to spawn a reverse bash shell."
The "kworker" worker process running on Zbtlink AX3000, which VulnCheck analyzed, is a customized version of rctl that's configured to contact the following -
47.107.224[.]
89
rbdg4nzqadui[.]wikaba[.]com
What's more, there is no handshake, negotiation, or authentication involved.
Once the implant sends a "hello" message to the server alongside the LAN MAC address, it's engineered to run whatever the server sends back in response.
"One reserved string, rctlbash, tells the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it," Baines explained.
"That is a live interactive root shell."
"The vocabulary of this protocol is two phrases: run this as root, and give me a root shell.
Anyone along the network path can hijack the client/server communication.
Anyone who controls the resolution of rbdg4nzqadui.wikaba[.]com, or the address it resolves to, can control any ENDLESSDOORS implant that tries to phone home."
An attacker can take advantage of this loophole to hijack the outbound rctl communications and obtain a live root shell, and take over control of the router without having to be reachable from the internet.
VulnCheck noted that every firmware listed on zbtlink.com's download page embeds the rctl implant and starts it at boot with an init.d script named "skworker."
The list of affected models is below -
CPE2801
WE1026-5G-WD
WE1326
WE2007
WE2008-DSIM
WE2416
WE3326
WE5927
WE5931
WE5931AC
WE826-T3-DSIM
WG108
WG1602
WG1608-DSIM
WG209
WG2105
WG2107
WG259
WG3526
Z8102AX-2DSIM
Each of these models have been found to have been found to dial the same set of four primary and secondary endpoints -
zbtctl.epplink[.]net (47.100.190[.]
96)
47.107.224[.]
89
online-string[.]com (45.32.81[.]
152)
rbdg4nzqadui.wikaba[.]com (43.248.136[.]
125)
As of writing, users visiting the firmware downloads page on Zbtlink's website are displayed the below message -
We have detected firmware security vulnerabilities affecting selected router firmware releases.
As a precautionary measure, the impacted firmware versions have been temporarily taken down from download channels.
Our engineering team is working intensively to develop and validate secured patched firmware.
We will notify you immediately once the fixed, security-validated firmware is available for release.
We apologize for the inconvenience caused.
Thank you for your understanding.
When contacted for comment, a spokesperson for the Chinese router manufacturer told The Hacker News that the feature is "solely intended" for after-sales maintenance and serves no other purposes.
"It is generally retained only on sample units to assist customers with software debugging," the spokesperson added.
"Our company specializes in OEM and ODM customization services."
"Our customers use their own self-developed software instead of ZBT's default firmware.
Customer security and privacy are our top priority.
We take this report very seriously and are working to expedite the implementation of a solution."
In the meantime, customers are advised to check the process list, scan the file system for files like /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and /etc/init.d/skworker, and block the egress points.
(The story was updated after publication to include a response from Zbtlink.)
Speakers
2speakers19%attributed speech541writer words
Selected voice
100%flagged-word coverageVulnCheck
50 attributed words40% of attributed speech85% writer coverage
Attribution is sentence-level. Pattern percentages are calculated only from words assigned to that voice.
Loading…
Loading…
Loading…
Loading…
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.