Ethical Hacking News
Researchers from VulnCheck have discovered a hidden backdoor in 20 different router models produced by Chinese manufacturer Shenzhen Zhibotong Electronics, also known as Zbtlink. This backdoor allows remote servers to execute commands as root, putting affected devices at risk of takeover. The vulnerability was triggered when the implant reaches a server, sending a fixed hello: a class label padded with nulls, then its LAN MAC address. Once connected, anything the command server sends gets executed as root through a basic system call, no allow-list, no sandbox, nothing filtering what commands are acceptable.
Researchers from VulnCheck discovered a backdoor called ENDLESSDOORS in 20 different router models produced by Shenzhen Zhibotong Electronics (Zbtlink). The backdoor allows remote servers to execute commands as root, putting affected devices at risk of takeover. The vulnerability was found after researchers purchased a Zbtlink AX3000 off Alibaba and discovered the hidden backdoor in the process list. The ENDLESSDOORS implant phones home to a hardcoded server and executes any command sent by the server as root without security checking. Affected routers dial out instead of listening for connections, making them vulnerable to takeover regardless of their firewall configuration. Zbtlink claims the backdoor was only intended for after-sales maintenance, but removed firmware downloads and acknowledged unspecified firmware security vulnerabilities. Users are recommended to check their router model number against the list of affected models, block the known command servers at their firewall, and replace the router if necessary.
Researchers from VulnCheck have made a groundbreaking discovery that sheds light on a previously unknown backdoor embedded in 20 different router models produced by Chinese manufacturer Shenzhen Zhibotong Electronics, also known as Zbtlink. This backdoor, named ENDLESSDOORS, allows remote servers to execute commands as root, putting affected devices at risk of takeover.
The vulnerability was discovered after researchers purchased a Zbtlink AX3000 off Alibaba and found the hidden backdoor in the process list disguised as a kernel thread. The two processes running as root with real memory footprints were dubbed "ENDLESSDOORS" by the researchers, built around a tiny open-source tool called rctl that nobody had touched since it was uploaded to GitHub back in 2015.
The ENDLESSDOORS implant phones home to a hardcoded server and once it connects, there's essentially no security checking who's on the other end. The vulnerability is triggered when the implant reaches a server, sending a fixed 39-byte hello: a 33-byte class label padded with nulls, then its LAN MAC address. Once connected, anything the command server sends gets executed as root through a basic system call, no allow-list, no sandbox, nothing filtering what commands are acceptable.
The researchers found that the affected router dials out instead of listening for connections, making none of the usual firewall logic helpful. A unit sitting behind three layers of corporate firewall is just as exposed as one sitting on the open internet, as long as it can reach the command server somehow. VulnCheck proved this wasn't theoretical by writing their own tool that impersonated the command server, catching the router's outbound connection and getting a root shell back in under two seconds.
The researchers pointed out that twenty different router models carry the same backdoor, all of them starting it automatically at boot through an init script named skworker. VulnCheck found the whole fleet dialing out to just four addresses total, hosted across Alibaba Cloud, Vultr, and a Chinese cloud provider, meaning whoever controls those servers controls every affected router in the world simultaneously.
Zbtlink claims that the backdoor was intended only for after-sales maintenance and not present in production devices. However, the company also removed firmware downloads and acknowledged unspecified firmware security vulnerabilities, raising further questions about its explanation. "This feature is solely intended for after‑sales maintenance and serves no other purposes," a company spokesman told The Register. "It is generally retained only on sample units to assist customers with software debugging and will not be included in mass‑production shipments."
In light of this discovery, it is recommended that users check their model number against the list of twenty affected router models, as the same hardware gets relabeled under multiple names. If you find the backdoor, block the four known command servers at your firewall, and if the router handles anything that actually matters, replace it rather than trust a company that just got caught lying about what it shipped. There is no patch coming for any of this, so the fix isn’t waiting around; it’s treating every affected device as compromised by design.
Related Information:
https://www.ethicalhackingnews.com/articles/Routers-Exposed-The-Zbtlink-Backdoor-Saga-ehn.shtml
https://securityaffairs.com/196785/security/researchers-discover-hidden-backdoor-in-20-router-models-allowing-remote-root-access.html
Published: Fri Aug 7 06:51:25 2026 by llama3.2 3B Q4_K_M
