The Router Came With a Root Backdoor. The Brand on the Box Hid Who Built It.

The newest findings concern two implants that VulnCheck named SPEAKINGSTONE and DARKLANTERN. They follow its earlier discovery of ENDLESSDOORS, a phone-home root implant tracked as CVE-2026-66747. The two newly documented issues are tracked as CVE-2026-74232 and CVE-2026-74233. Each has a CVSS 4.0 score of 9.3.

The ZBT router backdoors are not evidence that every device built by ZBT, or every product sold by a company that sources hardware from ZBT, contains the implants. They are evidence that the name on the box is a poor guide to who wrote the firmware, which services are listening and whose infrastructure the device may contact.

ZBT router backdoors appeared in more than one firmware generation

VulnCheck bought a Deep Orange 3G, 4G and LTE router for 88 US dollars from Amazon. The device was a white-labelled ZBT-WE826-T2 running firmware from 2019. That older image did not contain the previously disclosed ENDLESSDOORS implant.

It contained two different implants instead. Both were written in Nim, both used UDP, and both were launched by the same inetdetect process. The repetition matters because it points to a family of remote-management mechanisms rather than a single forgotten debug service.

DARKLANTERN ran as infosrvd on UDP port 9992. The stock firewall permitted inbound traffic from the internet. A probe could reveal the device model, firmware version, MAC address and other information without authentication or encryption. VulnCheck found that a hard-coded checksum salt and an all-zero MAC value could be used to bypass the command checks. One crafted packet could then reach a root shell.

That command-injection implant is tracked as CVE-2026-74233. VulnCheck scanned from 18 to 21 August and found 203 internet-facing instances across 22 countries and 16 self-reported device models.

The second implant could steal credentials and rewrite DNS

SPEAKINGSTONE ran as yunmgrd and contacted ZBT cloud infrastructure over UDP port 10000. Its primary domain was ac-link[.]com. The software also carried a backup command-and-control domain, findmyipaddr[.]com.

The implant sent a device fingerprint to the service and accepted plaintext, unauthenticated commands. VulnCheck documented functions for command execution, theft of PPPoE credentials, DNS manipulation, opening a reverse SSH tunnel and replacing the command-and-control address.

This cloud command implant is tracked as CVE-2026-74232. VulnCheck registered the forgotten backup domain and received connections from 392 devices. Of those, 390 were in China and most appeared to be on China Mobile. That sinkhole count shows that the dormant-looking backup channel still had real devices trying to use it. It does not establish the full number of affected routers.

The supply chain hides the firmware author

ZBT sells boards, routers and firmware into a global white-label market. VulnCheck identified products or reseller relationships spanning the United States, Canada, Australia, the Philippines, Germany and Russia. Names associated with ZBT hardware include Deep Orange, WiFlyer, WORDFI, HomeMyfi, Cioswi, CroSkylink, KuWFi, Digineo, ALLNET and MOFI.

That list should not be read as a declaration that every product from those brands is vulnerable. VulnCheck specifically examined MOFI custom firmware and did not find the implants. Resellers can replace or modify the firmware, and models sold under one name may use different internal hardware over time.

The operational problem is provenance. A buyer may know the retail brand and model but not the original design manufacturer, the firmware build chain or the cloud services embedded in the image. A conventional asset inventory can therefore be correct at the label level and wrong at the trust level.

This is a different risk from the compromised Cisco router covered in Someone Reprogrammed the Router Into a Listening Post. In that case, an intrusion actor modified trusted infrastructure after deployment. Here, the disputed capability was already present in firmware that reached customers.

How to find and contain ZBT router backdoors

• Identify the original hardware and firmware supplier, not only the brand printed on the enclosure.
• Check router images and running processes for rctl, kworker, yunmgrd, infosrvd and unexpected references to the disclosed cloud domains.
• Block unsolicited inbound access to UDP 9992 and restrict router management traffic at an upstream firewall.
• Monitor outbound UDP 10000 traffic and unexpected DNS queries from network equipment.
• Rotate PPPoE credentials and review DNS settings if a device is suspected of running the affected firmware.
• Replace unsupported devices when the supplier cannot provide a signed, documented firmware image and a credible update path.
• Segment cellular and edge routers from sensitive internal systems. Treat management traffic from them as privileged, not inherently trusted.

ZBT previously described ENDLESSDOORS as an after-sales technical-support tool used with customer request and authorisation. VulnCheck said it had not seen a public explanation for SPEAKINGSTONE and DARKLANTERN at the time of its later report. A remote-support purpose does not remove the security problem when the channel is unauthenticated, internet-reachable or controlled through infrastructure the customer did not knowingly approve.

The BlackTree view

The most consequential finding is not that one inexpensive router had an unexpected service. The ZBT router backdoors show that three privileged mechanisms appeared across firmware generations while the commercial supply chain obscured who built the device and who operated the surrounding infrastructure.

Security teams cannot solve that with a list of retail brands. Procurement needs firmware provenance, update commitments, a software bill of materials where available, and a clear account of every cloud service the device contacts. If the supplier cannot answer those questions, the router should not sit at the boundary of a trusted network.

Sources

• VulnCheck: DARKLANTERN and SPEAKINGSTONE, published 27 August 2026. The primary page provides a date but no publication time.
• VulnCheck: ENDLESSDOORS, published 5 August 2026. The primary page provides a date but no publication time.
• The Hacker News: China-made ZBT routers ship with two additional implants, published 28 August 2026. The page provides a date but no publication time.
• Tom’s Hardware: surveillance implants found in China-made routers sold worldwide, published 28 August 2026 at 14:13 UTC.