ZBT: Two New Factory Implants in Chinese Routers Expose Remote Root Access

The Discovery: Manufacturer Identified by MAC and Two New Implants

On August 28, 2026, The Hacker News confirmed through the IEEE registered MAC prefix database that the blocks 78:A3:51 and F8:5E:3C belong to Shenzhen Zhibotong Electronics, the Chinese company that sells routers under the Zbtlink brand. The identification allows tracing the manufacturer from the device MAC address, a relevant detail because many of these devices are sold white-label: the same hardware and firmware end up under different brands, so the model number is the only reliable check.

The confirmation comes as VulnCheck has documented two previously unknown factory implants in ZBT router firmware. The components, named SPEAKINGSTONE and DARKLANTERN, have been tracked respectively as CVE-2026-74232 and CVE-2026-74233. VulnCheck, as a CVE Numbering Authority, assigned both identifiers. The scores are high: 9.3 on CVSS 4.0 and 9.8 on CVSS 3.1 for both, with vectors that specify network attack, no privileges required, and no user interaction.

No advisory indicates a fixed firmware version. The two implants add to ENDLESSDOORS (CVE-2026-66747), a third malicious component disclosed by VulnCheck on August 5 and found in at least 20 Zbtlink router models.

SPEAKINGSTONE: A Surveillance Beacon with Remote Root

SPEAKINGSTONE is a service that runs under the name yunmgrd. It sends outbound beacons on UDP/10000 to a hardcoded command-and-control server: the primary domain is www.ac-link[.]com, which on August 28 still resolved to IP address 47.107.224[.]89, an Alibaba Cloud server located in Shenzhen. The protocol supports message types that allow a remote attacker to execute arbitrary commands as root, exfiltrate WAN PPPoE credentials, write and read a DNS hijacking list, and open a reverse SSH tunnel.

Because the traffic is outbound, it works from behind NAT and ordinary egress filtering, making the implant difficult to block. There is also a hardcoded backup C2, www.findmyipaddr[.]com, which VulnCheck registered because the domain was not registered. The backup server runs a reverse-engineered implementation of the protocol.

From the activation of the sinkhole until August 21, 392 unique devices connected to the backup. Of these, 390 were in China and 83% were on the China Mobile network; 304 broadcast an SSID with the CMCC prefix and 363 self-identified as model L3_V2_8 with firmware 3.0.0.4.528. VulnCheck notes that the backup is only reached when the primary C2 has never been configured, so 392 is a lower bound and does not represent the total number of affected devices.

DARKLANTERN: Command Injection on an Internet-Open UDP Port

DARKLANTERN is a service that listens under the name infosrvd on UDP/9992. The router's factory firewall opens that port to inbound connections from any Internet address, exposing the service directly to the network. Authentication is ineffective: it relies on a hardcoded salt and an all-zero wildcard MAC value that bypasses the address check.

VulnCheck describes the flaw as command injection. An unauthenticated remote attacker can exploit it to achieve command execution as root. Between August 18 and 21, VulnCheck identified 203 internet-facing DARKLANTERN instances in 22 countries, with 16 distinct self-declared models. The number counts hosts that responded to the probe, not devices already compromised.

DARKLANTERN responses travel on UDP/8897, but a Suricata rule published by VulnCheck uses port 8898. The discrepancy is known: the associated text and scanner use 8897, while the alert rule generates matches on 8898.

The ENDLESSDOORS Precedent and the Models Involved

ENDLESSDOORS (CVE-2026-66747) was disclosed on August 5. The official NVD entry reports a CVSS v3 of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and class CWE-506, embedded malicious code. According to the entry, it is present in every published build of the product line. The component is the open source tool ycsunjane/rctl compiled as an OpenWrt package librctl.so, started at boot and run as root with process name kworker, to blend in with kernel threads [kworker/*]. It does not open listening ports: it makes outbound clear-text TCP connections to a hardcoded C2, on port 7000 for commands and 7001 for the interactive shell, without authentication or encryption, repeating contact approximately every 35 seconds.

The advisories for the two new implants list numerous models and firmware builds. For DARKLANTERN, Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, WG3526 with firmware 19.1101, WE2426-C with firmware 19.1112, WE5926-EC_QP with firmware 20.0516, WF3526-P with firmware 19.051, and models from unidentified vendors such as CTN720-W1, LF-1541, MT7620N, and WRC1 appear. For SPEAKINGSTONE, L3_V2_8 with firmware 3.0.0.4.528, WE826-T2 with firmware 19.1101, ZBT-7628 and ZBT-ZBT7621 with firmware 1.0.x appear, along with MoreQuick models (MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, MQAP-7628) and many models from unidentified vendors. The advisory pages show the builds as upper bounds, while the CVE records report each firmware as a single exact build and set the status of every other version to “unknown”. No advisory indicates a fixed version.

MOFI Network, which develops its own firmware for the same platform, has an image examined by VulnCheck that was found free of the three implants.

What Readers Can Do: Mitigations and Indicators

There is currently no fixed firmware release for SPEAKINGSTONE and DARKLANTERN. VulnCheck recommends blocking inbound traffic to UDP/9992 at the network perimeter, thereby closing the DARKLANTERN listener until a patch is available. For SPEAKINGSTONE, the recommendation is to block and alert on endpoints both in egress and at the resolver level for the C2 domains, and to treat the router's LAN as untrusted.

To verify whether a device is produced by ZBT, the IEEE MAC prefixes 78:A3:51 and F8:5E:3C can be used. VulnCheck has published Suricata and YARA rules; anyone using them must account for the discrepancy in DARKLANTERN's response port (8897 in the scanner, 8898 in the rule).

The published indicators of compromise include the domains www.ac-link[.]com and www.findmyipaddr[.]com, the IP 47.107.224[.]89, ports UDP/9992, UDP/8897 (or 8898), and UDP/10000. The services involved are infosrvd, yunmgrd, and inetdetect; the relevant paths are /etc/exec/cmd, /tmp/info.txt, and /tmp/yunclient.conf. The SHA-256 hashes of the binaries are b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818 for yunmgrd, 7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245 for infosrvd, and ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926 for inetdetect.

Catalogs and Vendor Response

The CISA Known Exploited Vulnerabilities catalog in version 2026.08.27, verified on August 28, does not contain any of the three ZBT-related CVEs. CISA's KEV page lists 1685 total results, but no entry concerns Zbtlink or Shenzhen Zhibotong Electronics. Consequently, no remediation deadline is set for U.S. federal agencies for these specific CVEs.

Different is VulnCheck's catalog, which has placed CVE-2026-74233 in its own Known Exploited Vulnerabilities. VulnCheck's published criteria require that a vulnerability be “publicly reported as exploited in the wild”. The CISA Vulnrichment project, recorded for the same CVE on August 27, instead assesses exploitation as proof-of-concept: the agency's documentation defines that state as the existence of a public PoC at the time of analysis.

Zbtlink has responded only regarding ENDLESSDOORS. In a note on the site and through a spokesperson on August 6, the company stated that the component serves exclusively as a post-sales technical support tool, used only upon explicit request and authorization from the customer, that it “has never been used for unauthorized access” and that it would generally be present only on sample units for software debugging. There are no public statements on yunmgrd or infosrvd.

On August 28, Zbtlink's firmware download pages were active and served eight images dated August 17, including builds for WE826-T2 and WE2426-C, both models cited in the new advisories. The Hacker News contacted Zbtlink to ask whether the current firmware still contains the two components and VulnCheck for the evidence behind the cataloging: at publication no responses had been received.