Security researchers have discovered three pre-installed backdoor implants hidden inside firmware for widely distributed Chinese-made routers, exposing global networks to unauthorized remote hijacking.
The findings focus on hardware manufactured by Shenzhen Zhibotong Electronics, commonly known as ZBT, which builds networking gear sold globally under dozens of brand names. While ZBT claimed the software was merely an after-sales support tool, independent technical analysis revealed unauthenticated surveillance capabilities that bypass standard security defenses.
Uncovering the Hidden Backdoors
Investigations by cybersecurity firm VulnCheck found that ZBT router firmware contains factory-installed tools that can grant attackers full root control over affected devices.
The research began when analysts examined a Zbtlink AX3000 router and uncovered an implant dubbed ENDLESSDOORS, tracked as CVE-2026-66747. This component automatically phones home to command-and-control servers, letting remote operators run arbitrary system commands as root.
To test whether older devices harbored similar code, researchers purchased an $88 Deep Orange cellular router on Amazon. Although the white-labeled unit ran firmware from 2019, analysis uncovered two additional factory backdoors named SPEAKINGSTONE (CVE-2026-74232) and DARKLANTERN (CVE-2026-74233).
VulnCheck researcher Jacob Baines pushed back against vendor claims that the code was intended for routine customer maintenance. “This isn’t a memory corruption bug in a parser,” Baines stated. “It’s a component in the vendor’s product, started at boot by the vendor’s own init script, shipped across twenty models and years of images.“
Technical Breakdown of the Implants
The three implants employ distinct operational mechanisms, ranging from unauthenticated WAN network listeners to outbound phone-home beacons that easily bypass corporate firewalls.
Common Vulnerability Scoring System (CVSS) evaluations assigned critical severity ratings to both SPEAKINGSTONE and DARKLANTERN, marking them at 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0.
SPEAKINGSTONE operates via the yunmgrd service, phoning home to Alibaba Cloud servers (ac-link[.]com) and maintaining eight distinct surveillance functions. DARKLANTERN operates via infosrvd on UDP port 9992, allowing anyone on the internet to send root commands directly to exposed routers without entering a password.
Security controls inside DARKLANTERN are trivially bypassed because checksum verification relies on a static hardcoded salt, while MAC address filters clear upon receiving a MAC field of all zeroes.
Related: 10 Password Mistakes Hackers Love
Save this article
Enter your email address and we'll send it straight to your inbox.
Global Reach and White-Label Risks
Widespread white-label manufacturing obscures original hardware origins, leaving commercial buyers unaware that their networking gear contains ZBT firmware.
ZBT produces hardware for numerous independent brands, including WiFlyer, Cioswi, CroSkylink, KuWFi, Deep Orange, Lippert Components, Wave WiFi, Digineo, and MoreQuick. While some resellers build custom software, off-the-shelf units frequently retain stock ZBT firmware with factory backdoors pre-installed. During research, VulnCheck sinkholed an unregistered backup domain (www.findmyipaddr[.]com) embedded inside SPEAKINGSTONE.
Within days, 392 unique hardware devices connected to the sinkhole, 390 of which were in China (83% operating on China Mobile’s network and broadcasting “CMCC” SSIDs). This heavy concentration suggests large-scale domestic carrier deployments alongside international commercial sales.
Regulatory Pressure and Defense Strategies
Rising supply chain threats have prompted regulatory bans and stricter network isolation policies to protect critical communications infrastructure.
Regulatory studies show foreign-made routers contain an average of 32 security flaws per device, compared to 14 flaws on standard computers. These elevated risk levels have driven regulatory agencies like the US FCC to restrict foreign networking imports.
Security analysts advise administrators to audit hardware inventory by checking MAC address OUIs against ZBT manufacturing prefixes such as 78:A3:51. Defenders should block inbound WAN traffic on UDP port 9992 and restrict outbound traffic on UDP port 10000 at the firewall edge.
Because factory backdoors are deeply integrated into vendor firmware, analysts recommend replacing impacted hardware with platforms that support verified open-source operating systems.
Critical Security Takeaways
Factory-installed backdoors in white-labeled routers present serious supply chain vulnerabilities that require aggressive hardware auditing and network segmentation.
The discovery of ENDLESSDOORS, SPEAKINGSTONE, and DARKLANTERN highlights how obscure OEM firmware can expose global networks to silent surveillance and root compromise. Organizations must look beyond consumer branding to verify hardware origins and isolate vulnerable edge hardware before deployment.
What strategies should enterprises adopt to verify hardware supply chain integrity when purchasing white-labeled networking equipment from international vendors?
