Remote-Control Implant in Zbtlink Router Firmware Exposes Users to Unauthorized Access
CVE-2026-66747

9.3CRITICAL

Key Information:

Vendor: Zbtlink
Status: Cpe2801 Firmware; We1026-5g-wd Firmware; We1326 Firmware; We2007 Firmware
Vendor: CVE Published:; 5 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-66747?

The Zbtlink router firmware contains an embedded remote-control implant known as ENDLESSDOORS, present in all published builds. This implant is based on the open-source tool rctl, functioning as a package within OpenWrt (librctl.so). It operates at boot time with root privileges, disguising itself as a kernel process. By establishing cleartext TCP connections to a hardcoded command-and-control server, it exposes users to potential unauthorized access. An attacker could exploit this vulnerability to gain root access remotely due to the lack of authentication and encryption, allowing for unrestricted command execution.

Affected Version(s)

CPE2801 Firmware MIPS 22.10.09

WE1026-5G-WD Firmware MIPS 21.04.07

WE1326 Firmware MIPS 22.02.18_1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-66747 - Proof of Concept