Zbtlink Router Firmware Hidden Remote Access Backdoor

Executive Summary

CVE-2026-66747 involves a built-in backdoor called ENDLESSDOORS in Zbtlink router firmware. It disguises itself as a Linux kernel thread (kworker) and runs as root at boot. The implant phones home over cleartext TCP to hardcoded C2 servers on ports 7000 and 7001 without authentication or encryption. It allows attackers to execute arbitrary commands as root or spawn a reverse shell via the 'rctlbash' command.

The backdoor is derived from the open-source rctl tool and is embedded in the firmware as an OpenWrt package (librctl.so). It attempts to reconnect to C2 servers every 35 seconds and bypasses firewalls or NAT since the connection originates from within the network.

Useful 0 Not Useful 0

Detection Guidance

Check for unbracketed kworker processes running as root using 'ps aux | grep kworker'. Monitor outbound traffic on ports 7000 and 7001 with 'netstat -tulnp | grep -E "7000|7001"'. Inspect active connections to known C2 domains like zbtctl.epplink.net or rbdg4nzqadui.wikaba.com using 'nslookup' or 'dig'.

Use network monitoring tools to detect repeated TCP connections every ~35 seconds. Deploy detection rules for Suricata, Snort, or YARA to identify malicious activity patterns.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated remote attackers to gain root access to affected Zbtlink routers. Attackers can execute arbitrary commands, steal data, or use the device as a pivot point to compromise other systems on the network. Since the implant bypasses firewalls and NAT, it is accessible even to devices behind multiple layers of protection.

The lack of encryption and authentication means any party intercepting the C2 traffic or responding to it can take control of the device. This includes attackers performing DNS or route hijacking, or acquiring the hardcoded fallback domain.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and network security. GDPR mandates strict controls over unauthorized access to personal data, while HIPAA requires safeguards for protected health information. The backdoor's ability to grant root access and exfiltrate data could result in unauthorized data breaches, leading to legal penalties and reputational damage.

Organizations using affected Zbtlink routers may fail to meet compliance standards due to the lack of encryption, authentication, and audit controls. This could result in regulatory fines, mandatory breach notifications, and loss of customer trust.

Useful 0 Not Useful 0

Mitigation Strategies

Block known C2 endpoints at the network perimeter, including domains and IP addresses. Isolate affected devices behind strict egress controls or replace them entirely. Inventory devices by model number to identify vulnerable units.

Monitor for the 'rctlbash' command in logs or network traffic. Since no patch exists, containment is critical to prevent remote code execution as root.

Useful 0 Not Useful 0