CVE-2026-66747: CWE-506 Embedded Malicious Code in Zbtlink CPE2801 Firmware
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.
AI Analysis
Technical Summary
CVE-2026-66747 describes a critical vulnerability in Zbtlink CPE2801 firmware version 22.10.09, where an embedded remote-control implant called ENDLESSDOORS is included in every published build. This implant is implemented as the open-source rctl tool integrated as an OpenWrt package (librctl.so), running at boot as root under the process name 'kworker' to blend with kernel threads. It does not open any listening ports but phones home over unencrypted TCP to a hardcoded command-and-control server on ports 7000 and 7001. The implant lacks authentication, allowing any party controlling the C2 server or network path to execute arbitrary commands as root via popen(), including obtaining an interactive root shell. This represents a severe supply chain compromise and a backdoor in the firmware.
Potential Impact
The vulnerability allows unauthenticated remote attackers to execute arbitrary commands as root on affected Zbtlink CPE2801 devices. Because the implant communicates over cleartext TCP with no authentication, any entity that can intercept or respond to the implant's C2 communication can gain full control of the device. This compromises device confidentiality, integrity, and availability, enabling persistent remote access and potentially further network compromise.
Mitigation Recommendations
No official patch or remediation is currently available for this vulnerability. Since the implant is embedded in the firmware and runs at boot, mitigation options are limited. Users should monitor vendor advisories for updates or firmware patches. Network-level controls such as blocking outbound TCP connections to the known C2 ports (7000 and 7001) or to the hardcoded C2 server IP/domain may reduce risk but do not eliminate the vulnerability. Consider replacing affected devices if possible.
Indicators of Compromise
- cve: CVE-2026-66747
- hash: 00a1228648fffa7338076970037b89f679a166a08c4d9573f1f27973ec6ed497
- hash: 09ed9ad3ac886f5aaf8357127b6dd5926bd4af1e2cc687a6a4856bcaedee2667
- hash: 1545169fa8a3ae182d8e39aca8ec6cb6849b864e38646f29017232813e397e77
- hash: 2d558bc9a6c7e7480e946f1c0524a651554887a1c563d7633f1903d06ff493fb
- hash: 31ee58a134b766f6ed4424a22cc2cb08cfabbc9a5f35e0ae11a250c81ccc7f5e
- hash: 33f8c0532100eeb10213d167e5eb483394a7e43bf6d276441a1573360622011a
- hash: 37efadf0f4a110be0145139a43ebd032abb5b27b79b1eb2ab3578dcd31655a9e
- hash: 47d8ffb3a9a3fe0337e3c1e355fab4847dd61952fbe9aad98aadede489ca31fd
- hash: 4f5d8319b4bad5d9243496c1358fda4783ea9a0865c32881b3f57ecedb879570
- hash: 6926f919da7f4447229f49842266d884369e1587df655149673e46f1d8787e47
- hash: 71b20ebff0630b33c96bef320adc75901b34f1fd2cc9af974cf93ff37d102ec8
- hash: 73a0d95b8e23c7780cd91e978238c6db519665b05481fb228b4db9a9ec99c8ae
- hash: 76a17581bbde4c0550e8f4abfd903923aceeb50dc69dae4dd904628c273b90ee
- hash: 7791de11cd27cb596deff089904a6eab3a7e0aa391f867c2389582d5c78fef4c
- hash: ab8467e1495479693f4de8e838a5aeb61a65f3682d68f5b2d7c856cbfc91a247
- hash: b3956cfbebf9c8d0b2c7a2ecbe59e71c31a5802f2084d25d93a984c0f811e2c7
- hash: b3e667235e9b41b8fc3594edaa64879750e7f75d7518fff7514d55837430411a
- hash: b4fda77e082fbf961db02273999e92e715e1824140ea92b2ab30163338b6622b
- hash: dc1f4056af20677bdc7294ae4707f0c7bdfc85d8b57db212b622b9dc09c92731
- hash: dcdaa1fe80707b8d8fde8ad36c3e62a53623aff09bf5ccc544d4c1a1a54208b8
- hash: dee3908280b91cb7ad60c69c1d34c599ceed7c8c66c025851e5831482815b271
- hash: e85104fce4061d52d47f4528df9aaf656edc49f05c0f026c5bc6b65d57eb7f22
- hash: efc8a8ead69c63ecfffd883cfbe6bd131082aa13c0d3b324c00d79f4c149bd92
- hash: f019d03c2489b2bc486d71e355e07f8f2862dff078574a8662a5a45932e7e453
- hash: f5a94e536a1cac8552fb9c327c4bac6017e034786be98cc402a149cb51250d8f
- hash: f961e4243e759453294340bc7d1b145016d70b97ab328caf47c64ea3cd818148
- ip: 43.248.136.125
- ip: 47.100.190.96
- ip: 47.107.224.89
- hash: df1ae1a109b329689a1eb3d1bd9bd1e9ed247cfd
- domain: zbtlink.com
- domain: zbtwifi.com
- domain: rbdg4nzqadui.wikaba.com
- domain: zbtctl.epplink.net
- yara: df1ae1a109b329689a1eb3d1bd9bd1e9ed247cfd
CVE-2026-66747: CWE-506 Embedded Malicious Code in Zbtlink CPE2801 Firmware
Description
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.
CVSS v4.0
Score 9.3critical
Affected software
Zbtlink
CPE2801 Firmware
Zbtlink
WE1026-5G-WD Firmware
Zbtlink
WE1326 Firmware
Zbtlink
WE2007 Firmware
Zbtlink
WE2008-DSIM Firmware
Zbtlink
WE2416 Firmware
Zbtlink
WE3326 Firmware
Zbtlink
WE5927 Firmware
Zbtlink
WE5931 Firmware
Zbtlink
WE5931AC Firmware
Zbtlink
WE826-T3-DSIM Firmware
Zbtlink
WG108 Firmware
Zbtlink
WG209 Firmware
Zbtlink
WG259 Firmware
Zbtlink
WG1602 Firmware
Zbtlink
WG1608-DSIM Firmware
Zbtlink
WG2105 Firmware
Zbtlink
WG2107 Firmware
Zbtlink
WG3526 Firmware
Zbtlink
ZBT-Z8102AX-2SIM Firmware
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-66747 describes a critical vulnerability in Zbtlink CPE2801 firmware version 22.10.09, where an embedded remote-control implant called ENDLESSDOORS is included in every published build. This implant is implemented as the open-source rctl tool integrated as an OpenWrt package (librctl.so), running at boot as root under the process name 'kworker' to blend with kernel threads. It does not open any listening ports but phones home over unencrypted TCP to a hardcoded command-and-control server on ports 7000 and 7001. The implant lacks authentication, allowing any party controlling the C2 server or network path to execute arbitrary commands as root via popen(), including obtaining an interactive root shell. This represents a severe supply chain compromise and a backdoor in the firmware.
Potential Impact
The vulnerability allows unauthenticated remote attackers to execute arbitrary commands as root on affected Zbtlink CPE2801 devices. Because the implant communicates over cleartext TCP with no authentication, any entity that can intercept or respond to the implant's C2 communication can gain full control of the device. This compromises device confidentiality, integrity, and availability, enabling persistent remote access and potentially further network compromise.
Mitigation Recommendations
No official patch or remediation is currently available for this vulnerability. Since the implant is embedded in the firmware and runs at boot, mitigation options are limited. Users should monitor vendor advisories for updates or firmware patches. Network-level controls such as blocking outbound TCP connections to the known C2 ports (7000 and 7001) or to the hardcoded C2 server IP/domain may reduce risk but do not eliminate the vulnerability. Consider replacing affected devices if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-27T16:27:47.648Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Indicators of Compromise
Cve
| Value | Description | Copy |
|---|---|---|
cveCVE-2026-66747 | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash00a1228648fffa7338076970037b89f679a166a08c4d9573f1f27973ec6ed497 | — | |
hash09ed9ad3ac886f5aaf8357127b6dd5926bd4af1e2cc687a6a4856bcaedee2667 | — | |
hash1545169fa8a3ae182d8e39aca8ec6cb6849b864e38646f29017232813e397e77 | — | |
hash2d558bc9a6c7e7480e946f1c0524a651554887a1c563d7633f1903d06ff493fb | — | |
hash31ee58a134b766f6ed4424a22cc2cb08cfabbc9a5f35e0ae11a250c81ccc7f5e | — | |
hash33f8c0532100eeb10213d167e5eb483394a7e43bf6d276441a1573360622011a | — | |
hash37efadf0f4a110be0145139a43ebd032abb5b27b79b1eb2ab3578dcd31655a9e | — | |
hash47d8ffb3a9a3fe0337e3c1e355fab4847dd61952fbe9aad98aadede489ca31fd | — | |
hash4f5d8319b4bad5d9243496c1358fda4783ea9a0865c32881b3f57ecedb879570 | — | |
hash6926f919da7f4447229f49842266d884369e1587df655149673e46f1d8787e47 | — | |
hash71b20ebff0630b33c96bef320adc75901b34f1fd2cc9af974cf93ff37d102ec8 | — | |
hash73a0d95b8e23c7780cd91e978238c6db519665b05481fb228b4db9a9ec99c8ae | — | |
hash76a17581bbde4c0550e8f4abfd903923aceeb50dc69dae4dd904628c273b90ee | — | |
hash7791de11cd27cb596deff089904a6eab3a7e0aa391f867c2389582d5c78fef4c | — | |
hashab8467e1495479693f4de8e838a5aeb61a65f3682d68f5b2d7c856cbfc91a247 | — | |
hashb3956cfbebf9c8d0b2c7a2ecbe59e71c31a5802f2084d25d93a984c0f811e2c7 | — | |
hashb3e667235e9b41b8fc3594edaa64879750e7f75d7518fff7514d55837430411a | — | |
hashb4fda77e082fbf961db02273999e92e715e1824140ea92b2ab30163338b6622b | — | |
hashdc1f4056af20677bdc7294ae4707f0c7bdfc85d8b57db212b622b9dc09c92731 | — | |
hashdcdaa1fe80707b8d8fde8ad36c3e62a53623aff09bf5ccc544d4c1a1a54208b8 | — | |
hashdee3908280b91cb7ad60c69c1d34c599ceed7c8c66c025851e5831482815b271 | — | |
hashe85104fce4061d52d47f4528df9aaf656edc49f05c0f026c5bc6b65d57eb7f22 | — | |
hashefc8a8ead69c63ecfffd883cfbe6bd131082aa13c0d3b324c00d79f4c149bd92 | — | |
hashf019d03c2489b2bc486d71e355e07f8f2862dff078574a8662a5a45932e7e453 | — | |
hashf5a94e536a1cac8552fb9c327c4bac6017e034786be98cc402a149cb51250d8f | — | |
hashf961e4243e759453294340bc7d1b145016d70b97ab328caf47c64ea3cd818148 | — | |
hashdf1ae1a109b329689a1eb3d1bd9bd1e9ed247cfd | — |
Ip
| Value | Description | Copy |
|---|---|---|
ip43.248.136.125 | — | |
ip47.100.190.96 | — | |
ip47.107.224.89 | — |
Domain
| Value | Description | Copy |
|---|---|---|
domainzbtlink.com | — | |
domainzbtwifi.com | — | |
domainrbdg4nzqadui.wikaba.com | — | |
domainzbtctl.epplink.net | — |
Yara
| Value | Description | Copy |
|---|---|---|
yaradf1ae1a109b329689a1eb3d1bd9bd1e9ed247cfd | Zbtlink Router ENDLESSDOORS implant (rctl/kworker): /usr/sbin/kworker and /usr/lib/librctl.so. Plaintext, unauthenticated root C2 with an rctlbash PTY reverse shell. Matches MIPS and aarch64 builds. |
Threat ID: 6a731a7fbf8831d539c95c55
Added to database: 08/05/2026, 11:11:59 UTC
Last enriched: 08/12/2026, 12:41:53 UTC
Last updated: 09/19/2026, 22:01:36 UTC
Views: 152
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.