China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

A Chinese-made router manufacturer, Zhibotong Electronics (ZBT) through its brand Zbtlink, ships routers with two factory-installed implants – SPEAKINGSTONE and DARKLANTERN – that provide unauthenticated remote access to the devices. These implants allow an attacker to execute commands as root, exfiltrate data, and establish reverse SSH tunnels. The vulnerabilities have been exploited in the wild, with 392 unique devices reporting in, predominantly in China. Zbtlink has previously addressed the ENDLESSDOORS implant, but has not yet commented on the new vulnerabilities.