AINEWS
Shenzhen based ZBT, an original design manufacturer, white labels its routers for resellers worldwide; VulnCheck found three implants in shared firmware and impersonated one to take over a test device.
A "Deep Orange" cellular router listed for $88 on a US Amazon page looked like an unremarkable piece of white-box networking gear. It was actually a ZBT-WE826-T2, a router made by Shenzhen Zhibotong Electronics (ZBT) and resold under a name the buyer had never heard of. Researchers at VulnCheck bought one, pulled the firmware apart, and found three separate backdoor-like implants inside it.
The implants are named ENDLESSDOORS, DARKLANTERN, and SPEAKINGSTONE. ENDLESSDOORS disguises itself as the Linux kernel process "kworker," starts at boot, and phones home to a hard-coded command-and-control server with no real authentication or encryption. The commands it receives are passed straight to a shell running as root. DARKLANTERN runs as a service called "infosrvd" and opens a listener on the router's WAN side over UDP 9992, accepting commands directly. The vulnerability that lets it in is now tracked as CVE-2026-66747, with a CVSS score of 9.3. SPEAKINGSTONE sits in older 2019 firmware on the same white-labeled hardware.
VulnCheck did not stop at describing the implants. The team impersonated ENDLESSDOORS' command server against their own test router and obtained complete remote root control, according to the firm's writeup. That demonstration is what separates "backdoor" as a scare word from "backdoor" as a verified, repeatable result: any attacker who can hijack the C2 connection can do the same thing, on any of the affected devices, from the network edge.
The structural risk runs through the supply chain. ZBT is an original design manufacturer whose hardware is resold under dozens of brand names, and Tom's Hardware reports that VulnCheck traced ENDLESSDOORS to firmware for 20 ZBT models, including the Z8102AX, WG3526, and WE826-T3-DSIM, plus several cellular routers. FCC filings, patent records, and archived web pages tie the same ZBT hardware to brands across the United States, Canada, Australia, the Philippines, Germany, and Russia.
A consumer who bought a no-name or unfamiliar-brand router may be running firmware that came out of a single Shenzhen factory. A single implant in the shared firmware image propagates to every brand on top of it, because the reseller did not write the firmware and does not have a clean version to ship.
To see whether any of this is still live, VulnCheck stood up a sinkhole for the implant's command domain and watched beacons come in from hundreds of routers, almost all of them located in China, calling out to a forgotten domain that had been obfuscated in the firmware. The sinkhole is still running, so affected devices are still beaconing now.
Identify the router against the VulnCheck list of affected ZBT models and check the firmware version. If the device is on an affected build, replace it. There is no patch path that closes an implant baked into the firmware image, because the brand on the box did not build the firmware in the box.