An $88 cellular router bought from a US seller on Amazon turned out to be carrying two hidden backdoors. Researchers at VulnCheck found them after buying the Deep Orange unit and pulling its firmware apart.
The box said Deep Orange. The hardware was a white-labelled ZBT-WE826-T2, made by Shenzhen Zhibotong Electronics, known as ZBT. Its 2019 firmware was too old for the first implant VulnCheck had been chasing, but it held two others, which the firm named DARKLANTERN and SPEAKINGSTONE.
Three implants, three tricks
The work began with a Zbtlink AX3000. Its firmware contained ENDLESSDOORS, which starts at boot, dresses itself up as a Linux kernel process called kworker, and checks in with a hard-coded server. There is no meaningful authentication or encryption. Whatever the server sends goes straight to a root shell. VulnCheck proved the point by posing as the command server and taking over its own test router.
It found ENDLESSDOORS in firmware for 20 ZBT models, among them the Z8102AX, WG3526 and WE826-T3-DSIM. The issue carries the identifier CVE-2026-66747 and a CVSS score of 9.3.
DARKLANTERN runs as a service called infosrvd and listens on UDP port 9992 on the WAN side, taking commands from the internet with no authentication. One fixed 19-byte probe makes the router give up its model, firmware version, MAC address and uptime. The protections are thin. The checksum uses a static salt, “mqonu.com”, and the MAC filter can be defeated by sending a MAC field of all zeroes. Any remote attacker can forge a packet and run commands as root. A VulnCheck scan turned up 203 exposed DARKLANTERN instances in 22 countries, across 16 router models. That count covers only devices that answered the probe, not every affected router.
SPEAKINGSTONE works the other way round. It runs as yunmgrd and calls out over UDP port 10000 to ZBT’s command infrastructure, so a router sitting behind NAT or a firewall is no protection. Its command set lets an operator run arbitrary commands, steal WAN PPPoE credentials, rewrite a DNS hijack list and open a reverse SSH tunnel.
The sinkhole
The malware also carried a backup command-server domain that nobody had registered. VulnCheck registered it, www.findmyipaddr.com, and ran a server that spoke SPEAKINGSTONE’s protocol. By August 21st, 392 unique devices had connected. Of those, 390 were in China, mostly on China Mobile’s network, and most were the same model on the same firmware. That points to a carrier deployment, and VulnCheck calls it “domestic Chinese surveillance technology.”
Whose router is it?
Not every ZBT router is compromised. ZBT builds hardware for other companies, and VulnCheck found it sold under brands including Lippert Components, Wave WiFi, OneX in Australia, MoFI Network in Canada and Digineo in Germany. MOFI writes its own firmware, and VulnCheck said that firmware “didn’t contain any implants.” The same platforms have also appeared as WiFlyer, Deep Orange, Cioswi, CroSkylink and KuWFi, so the name on the plastic tells you little.
ZBT has described ENDLESSDOORS as an after-sales technical-support mechanism. VulnCheck’s answer is that, whatever the intent, the mechanism does not securely authenticate whoever is controlling it. Anyone who hijacks the traffic gets the same privileges.
Because the holes went in at the factory, a firmware update does not restore trust. Security teams are being urged to audit their networking gear, find any ZBT-based devices and replace them. VulnCheck lists affected models in its blog entries on the three implants.
Sources
- Chinese-made routers sold worldwide found with hidden surveillance implants
- Security researchers find surveillance implants in Chinese-made routers sold worldwide — three different backdoor-like implants hidden in firmware
Sources
- Security researchers find surveillance implants in Chinese-made…
- Chinese-made routers sold worldwide found with hidden…
