Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells

Published:

6 augustus 2026 om 08:05:22

Alert date:

6 augustus 2026 om 09:03:45

Source:

thehackernews.com

Network Infrastructure, Mobile & IoT, Supply Chain & Dependencies, Ransomware & Malware

Cybersecurity researchers at VulnCheck have disclosed a factory-shipped backdoor found in at least 20-21 Chinese router models manufactured by Zbtlink. The backdoor is present across all 21 firmware images available from Zbtlink, spanning more than two years of production. The implant is designed to start automatically upon device boot and attempts to beacon to Chinese infrastructure. The backdoor opens unauthenticated root shells, granting attackers full administrative access without any credentials. This represents a significant supply chain security risk as the malicious code is embedded at the firmware level before devices reach end users. The breadth of affected models and the multi-year timeframe suggest a deliberate and systematic implantation effort.

Technical details

VulnCheck discovered a factory-shipped backdoor named ENDLESSDOORS implanted in at least 20 Zbtlink router models, present across all 21 firmware images available from Zbtlink spanning more than 2 years. The backdoor is based on an open-source tool called rctl (remote control linux), uploaded to GitHub on January 14, 2015. The implant starts automatically at boot via an init.d script named 'skworker' and beacons to Chinese C2 infrastructure as frequently as every 35 seconds. It masquerades as a Linux kernel thread (kworker) but is actually a userland process running with root privileges. The protocol is unauthenticated — the implant sends a 'hello' message with the LAN MAC address to the server on port 7000, then executes any command the server returns. A special string 'rctlbash' triggers the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it — providing a live interactive root shell. The communication is unencrypted and unauthenticated, allowing any party along the network path to hijack the client/server communication. Anyone who controls DNS resolution of rbdg4nzqadui.wikaba.com or the IP it resolves to can control any ENDLESSDOORS implant. The implant files include /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and /etc/init.d/skworker.

Mitigation steps:

1. Check the router's process list for suspicious kworker processes running as userland processes. 2. Scan the file system for backdoor-related files: /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and /etc/init.d/skworker. 3. Block egress traffic to the known C2 endpoints: 47.107.224.89, rbdg4nzqadui.wikaba.com (43.248.136.125), zbtctl.epplink.net (47.100.190.96), and online-string.com (45.32.81.152), particularly on ports 7000 and 7001. 4. Monitor for outbound connections to these IP addresses and domains. 5. Avoid downloading firmware from Zbtlink's website until patched firmware is released and validated. 6. Wait for Zbtlink's security-patched firmware before reconnecting devices; monitor Zbtlink's firmware download page for updates. 7. Consider replacing affected routers with non-compromised alternatives if immediate remediation is required.

Affected products:

Zbtlink CPE2801
Zbtlink WE1026-5G-WD
Zbtlink WE1326
Zbtlink WE2007
Zbtlink WE2008-DSIM
Zbtlink WE2416
Zbtlink WE3326
Zbtlink WE5927
Zbtlink WE5931
Zbtlink WE5931AC
Zbtlink WE826-T3-DSIM
Zbtlink WG108
Zbtlink WG1602
Zbtlink WG1608-DSIM
Zbtlink WG209
Zbtlink WG2105
Zbtlink WG2107
Zbtlink WG259
Zbtlink WG3526
Zbtlink Z8102AX-2DSIM
Zbtlink AX3000