Remote-Control Implant in Zbtlink Router Firmware Exposes Users to Unauthorized Access

CVE-2026-66747

What is CVE-2026-66747?

CVE-2026-66747 is a severe vulnerability affecting Zbtlink router firmware, which is primarily designed to facilitate reliable network connections for various devices. This vulnerability includes an embedded remote-control implant known as ENDLESSDOORS that is included in all firmware versions. ENDLESSDOORS operates without authentication and sends sensitive information over a cleartext TCP connection to a hardcoded command-and-control (C2) server. The implant runs with root permissions, which allows it to execute arbitrary commands on the device. Since it is integrated into the firmware and runs as a benign process, it can evade detection, posing a significant threat to the users and organizations relying on these routers. Exploiting this vulnerability could lead to unauthorized access, compromising the integrity and confidentiality of networked devices.

Potential impact of CVE-2026-66747

1. Unauthorized Remote Access: The vulnerability facilitates unauthorized access to the affected devices, allowing attackers to execute arbitrary commands as root. This could enable a third party to gain complete control over the network and devices connected to it.

2. Data Breaches: With control over the router, attackers can intercept and manipulate network traffic, potentially extracting sensitive information transmitted over the network, leading to significant data breaches.

3. Propagation of Malware: The nature of the vulnerability allows attackers to install additional malware or other malicious software on networked devices, which could facilitate further exploitation or enable the establishment of a botnet for larger-scale attacks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

This is an advertDeploy the Patch →

References