Zbtlink router firmware contains a hidden remote-control implant called ENDLESSDOORS, embedded across all published firmware builds. The implant is based on the open-source ycsunjane/rctl tool, packaged as an OpenWrt library (librctl.so), and runs at boot as root while disguising itself as a kernel kworker thread. It establishes outbound cleartext TCP connections to a hardcoded C2 server on ports 7000 and 7001, with no authentication or encryption, retrying every ~35 seconds. Any received command is passed directly to popen() as root, and a special rctlbash command grants an interactive root shell. Because the channel is unauthenticated and unencrypted, any party able to intercept the connection, hijack DNS/routes, or acquire the hardcoded fallback domain can achieve full unauthenticated remote code execution as root. This represents a severe supply-chain and firmware-level backdoor affecting the entire Zbtlink product line. The vulnerability is categorized as a critical embedded implant with significant risk to network infrastructure security.