CVE-2026-66747 in Router Firmware
Summary
by MITRE • 08/05/2026
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/06/2026
The Zbtlink router firmware vulnerability represents a sophisticated supply chain compromise that embeds persistent backdoor functionality across all published firmware versions within the product line. This security flaw manifests through the inclusion of ENDLESSDOORS, an open-source remote control implant derived from the ycsunjane/rctl tool, which is compiled as an OpenWrt package and integrated into every firmware build. The implant operates with elevated privileges by leveraging the librctl.so library that executes at system boot time with root permissions, positioning itself strategically within the kernel's thread management system under the innocuous process name kworker to evade detection mechanisms.
The technical implementation of this backdoor demonstrates poor security practices through its hardcoded command-and-control infrastructure that operates without any form of authentication or encryption. The implant establishes communication with a predetermined server address using cleartext TCP protocols on two specific ports - port 7000 for command delivery and port 7001 for interactive shell callbacks. This communication pattern occurs approximately every 35 seconds, creating a persistent beacon that allows attackers to maintain long-term access to compromised devices without requiring additional authentication mechanisms. The implant's design relies entirely on the hardcoded server configuration, making it vulnerable to various attack vectors including network interception, DNS hijacking, or route manipulation.
The operational impact of this vulnerability extends far beyond simple unauthorized access, as the command handler within ENDLESSDOORS directly executes any received string through the popen() system call with uid=0 privileges, effectively granting full root-level control over affected routers. The inclusion of a reserved rctlbash command specifically enables attackers to obtain an interactive root shell, providing complete administrative access to the compromised device. This level of privilege escalation allows adversaries to modify router configurations, install additional malware, steal sensitive data, or use the compromised device as a pivot point for attacking other systems within the local network.
The vulnerability's design creates multiple attack surfaces that significantly amplify its risk profile and make it particularly dangerous in enterprise environments. Since the implant requires no authentication to establish control, any party capable of intercepting network traffic between the router and its command-and-control server can immediately assume administrative privileges over the device. This includes attackers who might occupy the network path through DNS cache poisoning, route hijacking, or simple network monitoring that captures cleartext communications. The lack of encryption also means that all commands and responses are transmitted in plain text, making them susceptible to man-in-the-middle attacks and providing attackers with complete visibility into the compromised system's operations.
This vulnerability aligns with several common security weaknesses documented in the Common Weakness Enumeration catalog including CWE-254, which addresses security features that are not properly implemented or configured, and CWE-917, which covers improper neutralization of special elements used in an expression. The implementation also reflects the ATT&CK framework's T1071.004 technique for application layer protocol: DNS, as the implant's communication patterns could potentially be obscured through DNS tunneling or manipulation. Additionally, this represents a classic example of T1543.003 for create or modify system process: run key, where malicious code is executed with elevated privileges during system initialization to establish persistent access.
The mitigation strategy for this vulnerability requires immediate firmware updates from Zbtlink to remove the embedded implant and replace it with secure versions that do not contain unauthorized backdoor functionality. Network administrators should implement network monitoring to detect unusual outbound traffic patterns on ports 7000 and 7001, which could indicate compromised devices within their network infrastructure. Organizations must also verify their network configurations to ensure proper DNS security measures are in place to prevent DNS hijacking attacks that could enable unauthorized access to the command-and-control infrastructure. Additionally, comprehensive network segmentation should be implemented to limit the potential lateral movement of attackers who might gain access through this backdoor, and regular security audits should be conducted to identify any other unauthorized modifications to router configurations or firmware images.