Two Factory Implants with Root Access Found in ZBT Router Firmware

VulnCheck has disclosed two previously unknown factory implants in the firmware of routers made by Shenzhen Zhibotong Electronics (ZBT). Each of them lets a remote attacker execute commands with root privileges without authentication and without any user interaction. The implants have been named SPEAKINGSTONE and DARKLANTERN and assigned the identifiers CVE-2026-74232 and CVE-2026-74233; both are rated 9.3 on CVSS 4.0 and 9.8 on CVSS 3.1.

How the implants work

SPEAKINGSTONE runs as the yunmgrd service and sends out beacons over UDP port 10000 to a hard-coded command-and-control server. Because the implant itself initiates the outbound connection, it operates from behind NAT and bypasses ordinary filtering. Its protocol can execute arbitrary commands as root, steal the login and password of a PPPoE WAN connection, spoof DNS and open a reverse SSH tunnel. VulnCheck flatly calls it a “spyware implant with root access to every device.”

DARKLANTERN is the infosrvd service on UDP port 9992, which the router's built-in firewall opens to incoming connections from anywhere on the internet. Its “authentication” rests on a hard-coded salt and a wildcard zero MAC address that bypasses its own check. Between August 18 and 21, researchers counted 203 internet-accessible instances of DARKLANTERN across 22 countries.

Scale and the naming dispute

Both implants were found on a Deep Orange router costing $88, purchased from a U.S. supplier — a rebadged ZBT-WE826-T2 running 2019 firmware. The problem is that ZBT sells the very same hardware and firmware to resellers under their own brands, so it is more reliable to go by the model number than by the brand. The list of affected devices includes dozens of Zbtlink and MoreQuick models, along with devices with no vendor specified.

VulnCheck registered a backup command-and-control domain for SPEAKINGSTONE that it found unclaimed and stood up its own implementation of the protocol on it. The beacons came in immediately: by August 21, 392 devices had responded, 390 of them in China, with 83% on the China Mobile network. But the authors are candid that this is only a lower bound, since only devices with no primary server configured reach out to the backup domain.

The manufacturer's response

Earlier, on August 5, VulnCheck disclosed yet another implant — ENDLESSDOORS. Zbtlink stated that it is an after-sales support tool that is activated only at a customer's explicit request and “has never been used for unauthorized access.” The company, however, has made no public statement about yunmgrd and infosrvd. Meanwhile, the firmware download pages remain live and are still distributing, among others, builds for the models mentioned in the new advisories. As of August 28, none of the three ZBT CVEs is listed in CISA's catalog of known exploited vulnerabilities.

Source: The Hacker News