IMPLICATOR
Twenty router models sold by Zbtlink shipped with an unauthenticated root-control component embedded in their firmware and enabled at boot. The software disguises itself as a Linux kworker process and calls an observed endpoint about every 35 seconds. A party able to answer or intercept that outbound connection could run commands with full control of the device.
On August 5, 2026, VulnCheck published the finding after examining 21 firmware images released over more than two years. The component, named ENDLESSDOORS, appeared across the examined images for routers sold under Zbtlink, Wiflyer and other storefront labels. The research did not establish active exploitation or identify the controller.
What Changed
- VulnCheck found ENDLESSDOORS in 21 firmware images covering 20 Zbtlink router models released over more than two years.
- The component starts at boot, calls an observed endpoint about every 35 seconds and accepts unauthenticated commands with root privileges.
- VulnCheck estimated possible exposure above 100,000 units worldwide, but that is not a count of compromised routers.
- Zbtlink disputes the backdoor label, suspended sales, removed affected firmware and said it was preparing updates.
AI-generated summary, reviewed by an editor. More on our AI guidelines.
A service hiding in the process list
A normal Linux kernel worker appears inside brackets in a router's process list and uses no ordinary user-space memory. On the AX3000 unit examined, two processes named kworker appeared without brackets and had their own memory footprints. One was the remote-control client, a modified version of the open-source rctl tool.
An initialization script starts the client each time an affected device boots. It then makes cleartext TCP connections to four observed endpoints, sending a class label and the router's LAN MAC address as its registration message.
The name helps the program blend into routine system activity. Its privileges matter more: it runs as root, the account with full control over the operating system.
The outbound path to root
ENDLESSDOORS performs no handshake, encryption or server authentication before accepting instructions. It also has no list restricting the commands it will run. Data received from the server is passed to popen() and executed as user ID 0.
A reserved command called rctlbash tells the client to connect again on port 7001, create a pseudo-terminal and launch /bin/sh. That gives the other end an interactive root shell.
Because the router initiates the connection, an operator does not need to find an exposed management port. The callback can cross ordinary network address translation in the same manner as other outbound traffic. The demonstration established control of the researchers' own AX3000 test device, not routers deployed elsewhere.
Get Implicator.ai in your inbox
Strategic AI news from San Francisco. No hype, no "AI will change everything" throat clearing. Just what moved, who won, and why it matters. Daily at 6am PST.
No spam. Unsubscribe anytime.
A larger pool with uncertain labels
Zbtlink is a brand of Shenzhen Zhibotong Electronics, a Chinese router manufacturer that sells OEM and ODM hardware for other companies through labels including Wiflyer and marketplaces including Amazon and Alibaba, rather than only under its own name. Its hardware can therefore reach buyers with a different logo. For owners, the model number is a more reliable identifier than the badge on the case.
The 20 confirmed models include products from the CPE, WE, WG and Z8102AX lines. VulnCheck estimated possible exposure at more than 100,000 units worldwide as of its August disclosure, but that figure is not a count of compromised devices. No reliable total is available for the United States.
Know someone who'd find this useful? ✉️ Email it to a friend in one click, or they can subscribe free here.
The research did not show that computers behind affected routers had been infected.
Zbtlink rejects the backdoor label
Zbtlink said the component was intended solely for after-sales maintenance. The company said it was generally kept only on sample units, used with customer authorization and never employed for unauthorized access.
After the disclosure, Zbtlink suspended sales of the affected models and removed the relevant firmware from its website. It also posted a notice acknowledging security flaws in selected releases.
Its announcement points customers toward replacement software: “We are currently developing and releasing firmware updates to fully resolve the issue with the rctl component,” Zbtlink said.
Frequently Asked Questions
What is ENDLESSDOORS?
ENDLESSDOORS is the name VulnCheck gave a remote-control component found in Zbtlink router firmware. It starts at boot, runs as root and accepts commands without authenticating the server.
Which routers are affected?
The confirmed list covers 20 models in Zbtlink's CPE, WE, WG and Z8102AX lines. Because the manufacturer also supplies white-label hardware, owners should check model numbers rather than relying only on the logo.
How can the component provide root access?
The router makes an outbound cleartext connection and passes received commands to the operating system as user ID 0. A reserved command can open an interactive root shell on port 7001.
Does the 100,000 figure mean 100,000 routers were compromised?
No. VulnCheck described more than 100,000 units as possible worldwide exposure. The research did not establish active exploitation or provide a reliable United States count.
How did Zbtlink respond?
Zbtlink said the component was intended for after-sales maintenance and used with customer authorization. It suspended affected-model sales, removed firmware and said updates were being developed.
AI-generated summary, reviewed by an editor. More on our AI guidelines.
Marcus Schuler
Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai
