Cybersecurity researchers at VulnCheck have disclosed a factory-shipped backdoor embedded in at least 20 router models manufactured by Chinese company Zbtlink, raising fresh concerns about supply-chain security in networking equipment.
The implant, dubbed ENDLESSDOORS, appears in all 21 firmware images currently available from Zbtlink and spans more than two years of releases. It starts automatically at boot and attempts to beacon to Chinese command-and-control infrastructure as often as every 35 seconds, masquerading as a legitimate Linux kernel thread while running with root privileges.
At its core, ENDLESSDOORS is a customized version of a tool called rctl (remote control linux), an obscure open-source repository uploaded to GitHub in 2015. The implant contacts several endpoints including an IP address at 47.107.224.89 and a dynamic DNS domain. There is no handshake, negotiation, or authentication involved. Once the implant sends a hello message with the LAN MAC address, it runs whatever command the server sends back.
The attack surface is particularly alarming because the protocol is so simple. One reserved command string tells the implant to open a second connection, allocate a pseudo-terminal, spawn a shell, and bridge it back to the attacker. That produces a live interactive root shell. Anyone who controls the C2 domain or its IP resolution can take over any affected router without needing internet-facing access to the device.
Affected models include the CPE2801, WE1026-5G-WD, WE1326, WE2007, WG1602, WG2105, WG2107, WG3526, and Z8102AX-2DSIM, among others. All models contact the same set of four primary and secondary endpoints for command relay. The firmware downloads page on Zbtlink website now displays a notice that impacted firmware versions have been temporarily removed while patched versions are developed.
VulnCheck CTO Jacob Baines explained that every firmware listed on the downloads page embeds the rctl implant and starts it at boot with an init.d script. The researchers recommended that affected users check their process list, scan for specific files associated with the implant, and block the identified egress points immediately.
The discovery echoes broader concerns about Chinese-manufactured networking equipment that have intensified in recent years. US and European officials have repeatedly flagged risks from Chinese gear vendors, and this finding of a pre-installed backdoor in commercial products validates those fears in concrete technical terms.
Sources: The Hacker News, VulnCheck
discussion