ZBT Routers Expose Critical Flaw with Factory-Installed Implants

"This is a surveillance implant with root access to every device it runs on," VulnCheck said in its supply chain research.

VulnCheck's discovery and severity ratings

Security researcher VulnCheck disclosed two previously undocumented factory implants in Shenzhen Zhibotong Electronics (ZBT) router firmware, naming them SPEAKINGSTONE and DARKLANTERN and assigning CVE identifiers CVE-2026-74232 and CVE-2026-74233. VulnCheck acted as the CVE Numbering Authority for both entries and rated each 9.3 on CVSS 4.0 and 9.8 on CVSS 3.1. Both vulnerabilities are network-accessible, require no privileges, and need no user interaction.

SPEAKINGSTONE (CVE-2026-74232): outbound C2 and full root control

SPEAKINGSTONE runs as the service yunmgrd and beacons over UDP port 10000 to a hardcoded command-and-control (C2) server. Because it dials outward, it functions behind NAT and ordinary egress filtering. VulnCheck reports the implant's protocol supports message types that execute arbitrary commands as root, exfiltrate the WAN PPPoE username and password, write and read a DNS hijack list, and open a reverse SSH tunnel.

The implant carries a hardcoded backup C2 domain that SPEAKINGSTONE reaches only where a primary server was never configured; VulnCheck found that backup unregistered, registered it, and stood up a server implementing the protocol. Beacons arrived immediately. As of August 21, 392 unique devices had reported in to that backup domain; 390 were in China, 83% were on China Mobile's network, 304 broadcast SSIDs beginning with "CMCC," and 363 self-reported model L3_V2_8 running firmware 3.0.0.4.528. VulnCheck warns that because devices only reach the backup where a primary C2 was never configured, the 392 devices are a floor rather than a census of affected units.

DARKLANTERN (CVE-2026-74233): an internet-facing listener with weak authentication

DARKLANTERN operates as the service infosrvd on UDP port 9992, which the router's stock firewall opens to inbound connections from any internet address. VulnCheck describes the service's authentication as ineffective, relying on a hardcoded salt and an all-zero wildcard MAC value that bypasses its own address check. The implant permits unauthenticated remote command execution as root.

Between August 18 and August 21, VulnCheck identified 203 internet-facing DARKLANTERN instances across 22 countries, self-reporting 16 distinct models; that count reflects hosts that answered a probe rather than devices found compromised. Because DARKLANTERN listens on UDP/9992, VulnCheck notes blocking inbound traffic to that port at the network edge closes the listener while a fixed firmware release is outstanding.

Affected models, firmware builds, and device identification

VulnCheck's advisories list model numbers and specific firmware builds as the observable markers for each implant. Notable listings include Zbtlink and white-labeled models such as WE826-T2, WE2426-C, WE5926 variants, L3_V2_8, ZBT-7628, ZBT-ZBT7621, and many others across the two advisories. The advisories display those builds as upper bounds while the CVE records name each firmware as a single exact build and set other versions to unknown; no single firmware release is named as fully fixed in the advisories.

Model number is the reliable check because ZBT sells the same hardware and firmware to resellers that put their own name on the case. The Hacker News confirmed via the IEEE-registered MAC prefix database on August 28 that MAC blocks 78:A3:51 and F8:5E:3C are assigned to Shenzhen Zhibotong Electronics, allowing owners to identify the manufacturer from the device's MAC address. The Hacker News also found Zbtlink's firmware download pages live and serving eight images dated August 17, including builds for WE826-T2 and WE2426-C.

Indicators, mitigation guidance, and vendor responses

VulnCheck published indicators of compromise (IoCs) that include:

• Domains: www.ac-link[.]com (SPEAKINGSTONE primary C2) and www.findmyipaddr[.]com (backup domain VulnCheck registered)
• IP: 47.107.224[.]89 (an Alibaba Cloud address in Shenzhen that the primary C2 domain still resolved to on August 28)
• Ports: UDP/9992 inbound (DARKLANTERN), UDP/8897 for its responses, and UDP/10000 outbound (SPEAKINGSTONE beacons)
• Services and paths: infosrvd, yunmgrd, inetdetect, /etc/exec/cmd, /tmp/info.txt, /tmp/yunclient.conf
• SHA-256 hashes: b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818 (yunmgrd); 7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245 (infosrvd); ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926 (inetdetect)

VulnCheck's guidance for earlier implants advised blocking and alerting on the endpoints at both the egress and the resolver, and treating the router's LAN as untrusted. The company published Suricata and YARA rules alongside the research; one rule alerts on DARKLANTERN command output arriving on UDP port 8898 while accompanying text and scanner use 8897.

VulnCheck added CVE-2026-74233 to its own Known Exploited Vulnerabilities catalog — a list whose published criteria require a vulnerability be "publicly-reported as exploited in the wild." CISA's Vulnrichment entry for the same CVE, recorded on August 27, rates exploitation as "proof of concept" (a public proof-of-concept existing at the time of analysis). The Hacker News confirmed via CISA's Known Exploited Vulnerabilities catalog, version 2026.08.27, that none of the three ZBT CVEs appear in it as of August 28.

Zbtlink has publicly addressed only the earlier ENDLESSDOORS component (CVE-2026-66747), calling it "solely" an after-sales technical support tool used only on a customer's explicit request and authorization and saying "This component has never been used for unauthorized access." Zbtlink has issued no public statement on yunmgrd or infosrvd. VulnCheck said the implants ship with ZBT firmware and pointed to MOFI Network, whose examined image for the same platform was free of the three implants.

What this means for technologists, procurement leaders, and end users

• Technologists and security teams: Use the published IoCs, block UDP/9992 at the network edge, monitor outbound UDP/10000 beacons, and apply VulnCheck's recommendations to treat affected router LANs as untrusted.
• Procurement and device managers: Verify devices by model number and, where possible, by MAC prefix (78:A3:51 and F8:5E:3C) rather than brand labels; note that the implants were found on a white-labeled ZBT-WE826-T2 and other reseller-branded units.
• End users and small organizations: Be aware the implants were present in factory firmware on inexpensive hardware (for example, an $88 Deep Orange 3G/4G/LTE Router whose firmware was built in 2019) and consider isolating such devices until vendors publish fixed releases.

The discovery ties unauthenticated, factory-installed implants to explicit CVE records and published IoCs, leaving a clear remediation pathway — block the listeners, monitor the beacons, and identify affected hardware by model and MAC prefixes — even as questions remain about how widely primaries were configured and which reseller images carry these components. More firmware-level transparency and vendor statements on yunmgrd and infosrvd would narrow the uncertainty; until then, defenders must act on the observable network signals VulnCheck and The Hacker News documented.

Original reporting: https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html