CVE-2026-66747: CWE-506 Embedded Malicious Code in Zbtlink CPE2801 Firmware
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.
AI Analysis
Technical Summary
CVE-2026-66747 describes a critical vulnerability in Zbtlink CPE2801 firmware version 22.10.09, where an embedded remote-control implant (ENDLESSDOORS) is present in every published build. This implant runs as root under the process name 'kworker' to evade detection and communicates over cleartext TCP to a hardcoded command-and-control server on ports 7000 and 7001. The implant lacks authentication and encryption, allowing any entity that can intercept or respond to the C2 communication to execute arbitrary commands as root via popen(), including obtaining an interactive root shell. This represents a severe backdoor compromising device integrity and security.
Potential Impact
The implant provides unauthenticated remote code execution with root privileges, enabling full control over the affected device. Because communication is unencrypted and unauthenticated, attackers can hijack the command channel by controlling the network path or the C2 server, leading to complete device compromise. This undermines device confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or remediation is currently available for this vulnerability. Users should monitor vendor advisories for updates. Due to the implant's nature, replacing the firmware with a trusted, clean version or discontinuing use of the affected device may be necessary until a fix is provided.
CVE-2026-66747: CWE-506 Embedded Malicious Code in Zbtlink CPE2801 Firmware
Description
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.
CVSS v4.0
Score 9.3critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-66747 describes a critical vulnerability in Zbtlink CPE2801 firmware version 22.10.09, where an embedded remote-control implant (ENDLESSDOORS) is present in every published build. This implant runs as root under the process name 'kworker' to evade detection and communicates over cleartext TCP to a hardcoded command-and-control server on ports 7000 and 7001. The implant lacks authentication and encryption, allowing any entity that can intercept or respond to the C2 communication to execute arbitrary commands as root via popen(), including obtaining an interactive root shell. This represents a severe backdoor compromising device integrity and security.
Potential Impact
The implant provides unauthenticated remote code execution with root privileges, enabling full control over the affected device. Because communication is unencrypted and unauthenticated, attackers can hijack the command channel by controlling the network path or the C2 server, leading to complete device compromise. This undermines device confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or remediation is currently available for this vulnerability. Users should monitor vendor advisories for updates. Due to the implant's nature, replacing the firmware with a trusted, clean version or discontinuing use of the affected device may be necessary until a fix is provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-27T16:27:47.648Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a731a7fbf8831d539c95c55
Added to database: 08/05/2026, 11:11:59 UTC
Last enriched: 08/05/2026, 11:27:43 UTC
Last updated: 08/06/2026, 02:06:53 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.