CVE-2026-66747: Zbtlink Router Backdoor ENDLESSDOORS Enables Unauthenticated Remote Code Execution as Root

TL;DR

VulnCheck found a Zbtlink router backdoor in every published firmware build across the product line. Named ENDLESSDOORS and tracked as CVE-2026-66747, it scores 9.8 on CVSS. It hands unauthenticated remote code execution as root to anyone who answers its command server.

Why it matters

The implant ships built in, not planted by a later attacker. It runs on at least twenty router models. Because the channel is unauthenticated, control is not limited to whoever placed it. Any party on the network path can take over.

How the backdoor works

The implant is the open-source rctl tool baked in as an OpenWrt package. It starts at boot and runs as root. To hide, it uses the process name kworker to mimic real kernel threads.

It opens no listening port. Instead, it phones home over cleartext TCP to a hardcoded command-and-control server. It retries roughly every 35 seconds. The command handler passes any received string straight to popen() as root.

This design makes the Zbtlink router backdoor easy to hijack. As VulnCheck notes in its ENDLESSDOORS research, anyone who occupies the C2 address, hijacks DNS or routing, or grabs the fallback domain gains root. This report withholds working exploit steps.

Exploitation status

VulnCheck published detection rules for the implant. However, no in-the-wild takeover campaign has been confirmed at this time.

Affected versions

The backdoor affects roughly twenty Zbtlink models. These include the CPE2801, WE1326, WG3526, and ZBT-Z8102AX-2SIM, among others. Check by model number, since branding varies.

What to do about it

No fixed firmware exists, so treat this as a device-trust problem. First, inventory devices by model number, not brand. Next, block and alert on outbound traffic to ports 7000 and 7001. Finally, segment or replace affected units, since the whole image is suspect.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.