China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access
VulnCheck discloses two factory implants, SPEAKINGSTONE and DARKLANTERN, in ZBT router firmware granting unauthenticated remote attackers root command execution.
VulnCheck found two previously undocumented implants in firmware from Shenzhen Zhibotong Electronics (ZBT), tracked as CVE-2026-74232 (SPEAKINGSTONE) and CVE-2026-74233 (DARKLANTERN), each rated 9.8 on CVSS 3.1. SPEAKINGSTONE (yunmgrd) beacons to a hardcoded C2 over UDP port 10000 and supports root command execution, PPPoE credential exfiltration, DNS hijacking, and reverse SSH tunnels; DARKLANTERN (infosrvd) listens on UDP port 9992 with weak hardcoded authentication. Scanning found 203 internet-facing DARKLANTERN instances across 22 countries, and 392 devices reported to the SPEAKINGSTONE backup C2, nearly all in China on China Mobile. No fixed firmware release is named, and ZBT's white-labeling means model number rather than brand is the reliable detection check.
- Both implants were found in 2019 firmware on a white-labeled ZBT-WE826-T2 router
- Affected lines include Zbtlink WE826 and WG series, MoreQuick MQAC/MQAP, and AP models
- IoCs include domains www.ac-link.com and www.findmyipaddr.com, plus IP 47.107.224.89
- VulnCheck lists CVE-2026-74233 in its own KEV catalog; CISA KEV has not yet listed the CVEs
- Prior ZBT implant ENDLESSDOORS (CVE-2026-66747) disclosed August 5, 2026
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1071.001 Application Layer Protocol: Web ProtocolsT1059 Command and Scripting Interpreter
- Organizations
- CISAChina Mobile
- Countries
- ChinaUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-66747 | Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line | 9.3 | <1% | ||
| CVE-2026-74232 | Backdoor implant in Zbtlink and MoreQuick routers allows unauthenticated root access | 9.3 | <1% | ||
| CVE-2026-74233 | Unauthenticated Root Command Injection in Zbtlink (ZBT) Router infosrvd Service | 9.3 | 3% |
From the original article
5 min read at thehackernews.com
VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics ( ZBT ), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices. The implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233 .
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.