China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

A Chinese-made router manufacturer, Zhibotong Electronics (ZBT) through its brand Zbtlink, ships routers with two factory-installed implants – SPEAKINGSTONE and DARKLANTERN – that provide unauthenticated remote access to the devices. These implants allow an attacker to execute commands as root, exfiltrate data, and establish reverse SSH tunnels. The vulnerabilities have been exploited in the wild, with 392 unique devices reporting in, predominantly in China. Zbtlink has previously addressed the ENDLESSDOORS implant, but has not yet commented on the new vulnerabilities.

SPEAKINGSTONE operates as a C2 implant, sending beacons over UDP port 10000 to a hardcoded C2 server. It supports message types that execute arbitrary commands as root, exfiltrate the WAN PPPoE username and password, and write and read a DNS hijack list, and open a reverse SSH tunnel. DARKLANTERN operates as an infosrvd service on UDP port 9992, which the router's stock firewall opens to inbound connections from any internet address. VulnCheck’s advisory describes the service’s authentication as ineffective, resting on a hardcoded salt and an all-zero wildcard MAC value that bypasses its own address check.

Between August 18 and August 21, VulnCheck identified 203 internet-facing DARKLANTERN instances across 22 countries, self-reporting 16 distinct models. The figure counts hosts that answered a probe rather than devices found compromised. Both implants were found on an $88 Deep Orange 3G/4G/LTE Router bought from a U.S. supplier, a white-labeled ZBT-WE826-T2 whose firmware was built in 2019. That unit predates ENDLESSDOORS (CVE-2026-66747), the phone-home implant VulnCheck disclosed on August 5 and found in at least 20 Zbtlink router models.

VulnCheck’s advisory for the DARKLANTERN command injection and its advisory for the SPEAKINGSTONE C2 implant name the following models and firmware builds -

• CVE-2026-74233 (DARKLANTERN) - Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108 and WG3526 on firmware 19.1101, WE2426-C on 19.1112, WE5926-EC_QP on 20.0516 and WF3526-P on 19.051, plus CTN720-W1, LF-1541 and MT7620N on 19.1101 and WRC1 on 20.0622, which the CVE record lists under an unidentified vendor.
• CVE-2026-74232 (SPEAKINGSTONE) - Zbtlink L3_V2_8 on 3.0.0.4.528, WE826-T2 on 19.1101, ZBT-7628 on 1.0.0.2.007 and ZBT-ZBT7621 on 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A and MQAP-7628 on 1.0.0.2.000, and AP522 on 1.0.0.2.014, AP7628 and HC5661A on 3.0.0.4.380, APG721B on 19.0809, HK300 on 1.0.0.2.032 and MAP-N10 on 1.0.0.2.044 under an unidentified vendor.

VulnCheck published the following indicators of compromise (IoCs) -

• Domains - www.ac-link[.]com, the SPEAKINGSTONE primary C2, andwww.findmyipaddr[.]com, the backup domain VulnCheck registered
• IP address - 47.107.224[.]89, an Alibaba Cloud address in Shenzhen that the primary C2 domain still resolved to when The Hacker News checked on August 28
• Ports - UDP/9992 inbound for DARKLANTERN, UDP/8897 for its responses, and UDP/10000 outbound for SPEAKINGSTONE beacons
• Services and paths - infosrvd,yunmgrd,inetdetect,/etc/exec/cmd,/tmp/info.txtand/tmp/yunclient.conf
• SHA-256 hashes - b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818(yunmgrd),7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245(infosrvd) andae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926(inetdetect)

VulnCheck's guidance for the earlier implant was to block and alert on the endpoints at both the egress and the resolver, and to treat the router's LAN as untrusted. Because DARKLANTERN listens on UDP/9992, blocking inbound traffic to that port at the network edge closes off the listener while a fixed release is outstanding. VulnCheck published Suricata and YARA rules alongside the research, one of which alerts on DARKLANTERN command output arriving on UDP port 8898 while the accompanying text and scanner both use 8897.

Zbtlink addressed the earlier ENDLESSDOORS component in a statement on its website, saying it serves solely as an after-sales technical support tool used only on a customer's explicit request and authorization. "This component has never been used for unauthorized access," the company said.

A Zbtlink spokesperson told The Hacker News on August 6 that the feature is "solely intended" for after-sales maintenance and serves no other purposes. "It is generally retained only on sample units to assist customers with software debugging," the spokesperson added.

That statement addresses ENDLESSDOORS alone, and Zbtlink has issued no public statement on yunmgrd or infosrvd. The Hacker News found on August 28 that the company's firmware download pages were live and serving eight images dated August 17, among them builds for the WE826-T2 and WE2426-C, both named in the new advisories.

VulnCheck said the implants ship with ZBT firmware, and pointed to MOFI Network, which develops its own firmware for the same platform and whose examined image was free of the three implants. The Hacker News has reached out to Zbtlink for comment on whether its current firmware still contains the two components, and to VulnCheck for the evidence behind its catalog listing, and will update this story with any response.