Researchers from VulnCheck report the discovery of a backdoor in Zbtlink routers that appears to already be present in the firmware. It is not a “standalone” component added later, but an implant that becomes active automatically during startup. Across multiple router models, the functionality is found in firmware images spanning more than two years.
What makes this especially concerning: the backdoor is designed to accept commands without authentication and can therefore provide a live, interactive root shell. This means the impact is not limited to data exfiltration or changing settings, but extends to full control over the network device itself.
What was found in the Zbtlink firmware?
According to the analysis, the implant is present in at least 20 Zbtlink router models. In total, 21 firmware images are available within the current Zbtlink overview that go back more than two years and in which the same backdoor is identified.
The researchers call the technique ENDLESSDOORS. The implant starts automatically during the boot process and periodically attempts to connect to command-and-control (C2) infrastructure, with an interval that quickly comes into focus: approximately every 35 seconds.
Why does it look like legitimate router processes?
The backdoor disguises itself as a process that resembles a Linux kernel thread. In reality, it runs as a set of userland processes operating with root privileges, while attempting to match how normal workflow processes look or are named.
In the studied router (Zbtlink AX3000), it concerns a modified “kworker” worker. VulnCheck describes that this worker is not only “present” but configured to reach the configured C2 destinations.
The mechanism: “rctl” as the basis for command execution
At the core of ENDLESSDOORS, VulnCheck links it to a small utility: rctl (remote control linux). According to the researchers, this component was originally placed in an obscure GitHub repository (in 2015) and has not been updated since.
The workflow works roughly like this:
- The server listens for clients on port 7000.
- The client can then receive individual shell commands.
- In addition, the server can instruct it to start a reverse bash shell.
Key detail: according to VulnCheck there is no handshake, negotiation, or authentication. Once the implant sends a “hello” message, including data such as the LAN MAC address, the logic proceeds based on what the server sends back.
From commands to a live root shell
The analysis shows the protocol’s functionality is essentially one-to-one: commands like “run this as root” and “give me a root shell.” A reserved string, rctlbash, triggers the next step.
Concretely: the implant opens a second connection to another port (7001), sets up a pseudo-terminal, starts /bin/sh, and relays that session live. In practice, this results in an interactive root shell.
Why doesn’t an attacker need to be directly on the internet?
Because the router itself initiates outbound contact to the C2, an attacker can benefit from the fact that the device “phones home” to the outside. The researchers note that the scenario can also work even if the router is not directly reachable from the internet.
There is also an additional weakness in the design: anyone who can redirect communications, or control how a domain is translated into an IP address, could in principle influence which server the implant ultimately reaches. In the described approach, one of the C2 destinations is referenced with a domain whose resolution becomes part of the influence path.
Which router models are affected?
The list of models in which the backdoor was found (as mentioned by VulnCheck) includes, among others, the following Zbtlink types:
- CPE2801
- WE1026-5G-WD
- WE1326
- WE2007
- WE2008-DSIM
- WE2416
- WE3326
- WE5927
- WE5931
- WE5931AC
- WE826-T3-DSIM
- WG108
- WG1602
- WG1608-DSIM
- WG209
- WG2105
- WG2107
- WG259
- WG3526
- Z8102AX-2DSIM
The exact impact may differ per firmware version, but at the core it involves an embedded implant that becomes active at boot and then seeks out contact.
Targets for “phone home”: four endpoints
VulnCheck states that the devices are configured to communicate with the following primary and secondary endpoints when they connect:
- zbtctl.epplink[.]net (47.100.190[.]96)
- 47.107.224[.]89
- online-string[.]com (45.32.81[.]152)
- rbdg4nzqadui.wikaba[.]com (43.248.136[.]125)
For network administrators, this means that monitoring outbound connections and selectively blocking these outbound routes can be a direct defensive step.
What did Zbtlink do after the discovery?
Based on the available information, the firmware download page was temporarily modified. Visitors are told that firmware security issues were identified for selected releases.
As a precaution, the affected firmware versions would have been temporarily removed from the download channels. At the same time, the page indicates that the engineering team is working on developing and validating secure, patched firmware. Once that is ready, an update would follow.
The researchers report that they contacted the manufacturer for comments, but no direct response was incorporated into the report at the time of publication.
What can you do now as an administrator?
While waiting for a verified update, the researchers advise users to proactively check and block outbound communications. Below are actions that align with the guidance from the disclosure.
1) Check whether the processes are present
Review the process overview for suspicious or disguised processes that are active. VulnCheck lists the following file and process indicators to look out for:
- /usr/sbin/kworker
- /usr/lib/librctl.so
- /etc/kworker.cfg
- /etc/init.d/skworker
If you find these elements, it is a strong indication that the implant (or a variant) is present.
2) Check and restrict outbound traffic
Since the router itself contacts the C2 destinations, egress blocking is a logical step. Apply targeted blocks to the endpoints described by VulnCheck so the “phone home” route is interrupted.
Do this using your firewall rules, network segmentation, and DNS policy. Also account for the fact that domain resolution can be abused in the chain; therefore, it helps to include both IP addresses and relevant domains in your checks.
3) Implement a staged update policy
When Zbtlink later publishes patched firmware, it’s important not to roll out upgrades “blindly.” Preferably test the firmware first in a controlled environment, then verify that the suspicious processes and outbound connections no longer reappear.
Want to take a broader look at how this kind of supply-chain or “factory-shipped” risk is handled in practice? Read our explanation of supply chain attacks and embedded backdoors.
Why this type of backdoor is so hard to detect
The problem with implants like this is not only that they “do something in the background,” but that they try to blend in with normal router functionality. By making userland processes look like common workers, traditional monitoring based on process names or simple heuristics can fall short.
In addition, the communication pattern is periodic and command construction does not require authentication. As a result, once the system makes contact, it can start executing immediately when the server sends something back.
Similar points of attention: command-and-control and MFA
In the field, we more often see attacks that don’t rely on a single vulnerability, but on a combination of access paths and control mechanisms. That makes it useful to also stay alert for misuse of authentication chains and for malware that doesn’t just read via “management channels,” but also executes.
For relevant material on these patterns (for example, when attacks bypass MFA), see lessons around MFA after an incident.
Conclusion
The report about a backdoor in Zbtlink shows how powerful and far-reaching a “factory-shipped” implant can be. ENDLESSDOORS starts automatically, periodically seeks C2 contact, and can open an interactive root shell without authentication.
Until patched firmware is available and validated, the best approach is: check for suspicious processes and files, plus block outbound traffic to the listed endpoints. This reduces the chance that a device can still receive and execute commands.
Source: https://thehackernews.com/2026/08/chinese-made-zbtlink-routers-ship-with.html
