The surveillance seems aimed at the domestic market, but it knocks huge holes in the security of the devices it's found in.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works .
ENDLESSDOORS is essentially a remote-control system embedded directly into the router's firmware. It starts automatically at boot and disguises itself as a normal Linux kernel process called kworker. The router periodically connects to a hard-coded server and announces itself. There's no meaningful authentication or encryption involved. Commands received from the server are passed directly to a shell running as root, and the implant can also establish an interactive root shell.
VulnCheck demonstrated the problem by impersonating the command server and taking control of its own test router. In other words, this isn't merely a theoretical vulnerability; if an attacker can hijack the connection to the implant's command server, they can obtain complete control of the router. The researchers found ENDLESSDOORS embedded in firmware for 20 ZBT models, including the Z8102AX, WG3526, WE826-T3-DSIM, and several other cellular routers. The same hardware is also sold under other names because ZBT manufactures routers for OEM and ODM customers. VulnCheck assigned the issue CVE-2026-66747, with a CVSS score of 9.3, but that wasn't the end of the investigation.
VulnCheck subsequently bought an $88 Deep Orange cellular router from a US seller on Amazon and discovered that it was actually a white-labeled ZBT-WE826-T2. Its 2019 firmware was too old to contain ENDLESSDOORS, but instead, it contained two other implants that the firm designated DARKLANTERN and SPEAKINGSTONE.
DARKLANTERN is the particularly straightforward one. Operating as the infosrvd service, it opens a listener on the WAN via UDP port 9992 and accepts commands directly from the Internet without authentication. An attacker only needs to send a fixed 19-byte info probe to force the router to reveal identifying information like its model, firmware version, MAC address, and uptime.
Hidden backdoor found in Tenda routers lets attackers log in as admin without a password
Geekom admits to shipping malware-laced network drivers for AMD mini PCs
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/security-researchers-find-surveillance-implants-in-chinese-made-routers-sold-worldwide-three-different-backdoor-like-implants-hidden-in-firmware#main
- https://www.tomshardware.com/membership
- $215 discount turns Corsair's DDR5-6000 Vengeance memory kit into the cheapest 32GB of RAM at those speeds — 35% saving as stock dwindles and prices continue to
- Micron workers increasingly support strike over bonus pay — labor union wants profit-sharing scheme, as employees at Samsung, SK hynix enjoy bonuses worth hundr
- Resurrected RTX 3060 12GB price jumps 45% in the two months since it was revived — 2021-era GPU now costs nearly $500 across most retailers
- Ingenious indie hacker funds $3,000 MacBook purchase by selling advertising space on the lid — sticker space auction has already raised 111% of the price of the
- Cloudflare frees up 100TB of RAM by shrinking 1.1.1.1's DNS cache entries — 250 billion cached DNS entries at any given time means one wasted byte costs 250GB
Informational only. No financial advice. Do your own research.