A Root Shell Shipped From the Factory in 21 Firmware Images Across Two Years. ENDLESSDOORS Was Never Broken Into — It Was Built In. Six IOCs Are In Our Feed Now.

VulnCheck disclosed on 5 August that at least twenty-one router models from the Chinese vendor Zbtlink ship with a persistent remote access implant installed at the factory. They named it ENDLESSDOORS and it carries CVE-2026-66747, CVSS 9.3, classified CWE-506 — embedded malicious code. The research is theirs, and they published Suricata, Snort and YARA signatures alongside the advisory, which is the behaviour you want from a disclosure and worth saying out loud.

We are writing because the indicators were not in our feed and now they are. All six were confirmed absent when we checked, ingested at confidence 90, and verified in-feed by read-back before this sentence was written. If you pull our high-confidence feed you are already blocking them.

What was actually shipped

The implant launches at boot and runs commands with full administrative control. It presents itself as kworker, the name of a routine Linux kernel worker thread, which is a good enough disguise to survive a casual ps from someone who is not specifically hunting.

The code is a modified build of rctl, a remote control utility posted publicly to GitHub in 2015 and abandoned there since. Somebody found an unmaintained tool, changed it, and put it in a production firmware image.

There is no encryption. There is no authentication. Commands arrive from the command-and-control server and are executed directly as root through popen. Sending one specific string opens an interactive root shell on port 7001. That is the entire access-control model.

It beacons outbound roughly every thirty-five seconds, with a thirty-nine-byte handshake carrying a class identifier and the device's LAN MAC address.

The part that makes this a supply chain story rather than a vulnerability

It is present in all twenty-one firmware images currently published by Zbtlink, spanning more than two years of releases. This was not introduced in a bad build. It is a constant across the release history.

More than 100,000 units are in service worldwide, sold through mainstream retail channels under at least four brand names: Zbtlink, ZBT, Wiflyer and ZBTWiFi. A buyer picking a router off a marketplace listing under one of the downstream brands has no obvious path to knowing which OEM built it.

Zbtlink denies malicious intent and describes the component as an after-sales maintenance feature. They also quietly pulled the affected firmware before 31 July and promised patches. We will let those two facts sit next to each other without further comment.

For what it is worth, the "maintenance feature" framing is not automatically dishonest — vendors do ship remote support tooling. The problem is that a maintenance channel with no authentication, no encryption, and a hardcoded string that yields root is indistinguishable from a backdoor in every way that matters to the person owning the device. Intent is a question for lawyers. Exposure is the same either way.

What we did with it

The full indicator set from the advisory:

Command-and-control domains: zbtctl.epplink[.]net, online-string[.]com, rbdg4nzqadui.wikaba[.]com. Command-and-control addresses: 47.107.224.89 (Alibaba Cloud, Shenzhen), 47.100.190.96, 43.248.136.125. Ports TCP 7000 and 7001.

Host artifacts to hunt for on a suspect device: the process kworker running from /usr/sbin/kworker rather than as a kernel thread, plus /usr/lib/librctl.so, /etc/kworker.cfg and the init script /etc/init.d/skworker. A genuine kernel worker does not live in /usr/sbin and does not have a config file.

We checked every one of the six network indicators against our corpus before ingesting. All six returned found: false — we did not have them. They are now in the feed at confidence 90 with the campaign source manual-batch-endlessdoors, each write confirmed by primary-key read-back rather than by the API returning a cheerful acceptance. Two of the six initially came back queued behind the index write lock; we re-verified rather than re-ingesting, and both landed.

Confidence 90 clears our blocking threshold, so these flow into the IP and domain blocklists that feed the edge shield. That is the whole point of writing this today rather than next week.

Why we are not claiming a lead

We found none of this. VulnCheck did, and the Cloud Security Alliance published the research note. Our contribution is distribution: we took a published indicator set that a lot of small operators will never see, put it into a free feed, and confirmed it landed. That is worth doing and it is not the same as detection, and a threat-intel shop that blurs those two is selling you its ingest timestamp.

The honest framing of our value here is speed and reach, not discovery.

What to actually do

If you own a Zbtlink, ZBT, Wiflyer or ZBTWiFi device, or a router you bought cheaply and cannot identify the OEM for, block outbound traffic to the three addresses and three domains above and alert on any outbound connection to TCP 7000 or 7001 from your network edge. A thirty-five-second beacon is a very visible pattern in netflow once you know to look for it.

Then check the device: a kworker process with a path under /usr/sbin, or the presence of /etc/kworker.cfg, is conclusive. VulnCheck's Suricata, Snort and YARA signatures are the better detection route if you run any of those, and they are published.

The affected models named in the advisory are CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526 and ZBT-Z8102AX-2SIM.

If you are an ISP or MSP with any of these in a customer fleet, the beacon interval makes this cheap to find at aggregate level without touching a single endpoint.

The wider pattern, briefly

Yesterday we wrote about an extortion crew claiming firmware, signing certificates and deployment packages taken from a hospital medication vendor. Today it is a router vendor shipping a root shell from the factory across two years of releases. Different actors, different motives, same layer.

Firmware is the part of your estate you did not write, cannot easily read, and mostly cannot verify. The industry has spent a decade building tooling to inspect dependencies in software you build and almost none to inspect the software that arrives already inside the hardware you bought.

We guarantee five percent of what we publish is wrong. Here the disclosures are: the research is VulnCheck's and not ours, we hold no first-party observation of this implant beaconing, the "maintenance feature" characterisation is the vendor's own account and unverified either way, and our contribution is redistribution of a published indicator set into a free feed.

---

Her name was Renee Nicole Good.

His name was Alex Jeffery Pretti.