Summary
- The EndlessDoors implant starts at boot, disguises itself as a kernel-worker process, and repeatedly contacts hard-coded infrastructure.
- Commands are accepted without authentication or transport encryption and run with root privileges.
- The implant’s origin, intended purpose, deployment scale, and history of active use remain unresolved.
A remote-control implant embedded in 20 models of Zbtlink router firmware can accept unauthenticated commands and execute them with root privileges.
VulnCheck named the implant EndlessDoors and assigned it CVE-2026-66747. The company rated the issue critical, with a CVSS 4.0 score of 9.3.
The affected firmware contains an open-source remote-control tool packaged as librctl.so. It starts when the router boots and runs as root under the process name kworker, resembling the naming convention used by legitimate Linux kernel-worker processes.
Rather than opening an inbound listening port, the component repeatedly contacts a hard-coded command-and-control destination over cleartext TCP. It attempts to connect approximately every 35 seconds, using one port for commands and another for an interactive-shell callback.
The channel has no authentication and no transport encryption. According to VulnCheck, any party able to control the configured destination, intercept the network path, hijack routing or domain resolution, or acquire the fallback domain could issue commands to the router.
Received strings are passed to a system function and executed as root. A reserved command can also return an interactive privileged shell, giving the controlling party extensive authority over the device.
The disclosed affected list covers 20 firmware and model combinations, including cellular and conventional routers used in homes, small businesses, remote sites, and other environments. VulnCheck said the implant appeared across every published build it reviewed within the affected product line.
The finding establishes the technical capability but does not establish who introduced it or why. The component could have originated as an undocumented support facility, a development mechanism that reached production, or deliberately concealed access. No public evidence has established its provenance or connected it to a government.
There is also no published evidence showing how frequently the command infrastructure has been used against deployed routers. The repeated outbound connection creates an observable signal, but organisations must first know that the device exists and retain sufficient network telemetry to identify it.
Routers occupy a privileged position between local devices and external networks. Root access can permit changes to configuration, interception or redirection of traffic, persistent access, and attempts to reach systems behind the device.
Asset identification may be difficult where routers were purchased through resellers, online marketplaces, regional integrators, or operational teams outside central IT procurement. Product branding may also differ from the underlying firmware and hardware manufacturer recorded in an advisory.
VulnCheck’s public advisory did not identify a vendor patch. Where trusted replacement firmware is unavailable, removing or replacing the device may provide a more dependable outcome than attempting to disable one observed process.
The confirmed problem is an embedded, unauthenticated, unencrypted root-control channel. Its purpose, operator, deployment footprint, and previous use remain unknown.
