Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-66747— ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant

Quick assessment

Affected
Zbtlink CPE2801 Firmware
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zbtlink cpe2801 firmware是Zbtlink公司的一款路由器固件。 Zbtlink cpe2801 firmware存在处理逻辑错误漏洞，可能导致攻击者利用漏洞破坏系统的机密性、完整性或可用性。

CVSS 9.8 · Critical EPSS 0.79% · P55

Affected Version Matrix 20

VendorProduct Version RangeStatus
Zbtlink CPE2801 Firmware 22.10.09 affected
Zbtlink WE1026-5G-WD Firmware 21.04.07 affected
Zbtlink WE1326 Firmware 22.02.18_1 affected
Zbtlink WE2007 Firmware 23.08.12 affected
Zbtlink WE2008-DSIM Firmware 23.08.11 affected
Zbtlink WE2416 Firmware 21.03.22_1 affected
Zbtlink WE3326 Firmware 20.09.30 affected
Zbtlink WE5927 Firmware 22.08.10 affected
Zbtlink WE5931 Firmware 22.05.31 affected
Zbtlink WE5931AC Firmware 22.05.31 affected
Zbtlink WE826-T3-DSIM Firmware 21.12.21 affected
Zbtlink WG108 Firmware 21.08.06_1 affected
Zbtlink WG1602 Firmware 23.10.11 affected
Zbtlink WG1608-DSIM Firmware 23.03.16 affected
Zbtlink WG209 Firmware 21.07.28 affected
Zbtlink WG2105 Firmware 22.05.30 affected
Zbtlink WG2107 Firmware 22.09.08 affected
Zbtlink WG259 Firmware 21.03.23 affected
Zbtlink WG3526 Firmware 22.11.01 affected
Zbtlink ZBT-Z8102AX-2SIM Firmware 7.6.7.2-25.0814_114432 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-66747

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant
Source: CVE Program / CVE List V5
Vulnerability Description
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
内嵌的恶意代码
Source: CVE Program / CVE List V5
Vulnerability Title
Zbtlink cpe2801 firmware 处理逻辑错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Zbtlink cpe2801 firmware是Zbtlink公司的一款路由器固件。 Zbtlink cpe2801 firmware存在处理逻辑错误漏洞，可能导致攻击者利用漏洞破坏系统的机密性、完整性或可用性。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Zbtlink CPE2801 Firmware 22.10.09 cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:*
Zbtlink WE1026-5G-WD Firmware 21.04.07 cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:*
Zbtlink WE1326 Firmware 22.02.18_1 cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:*
Zbtlink WE2007 Firmware 23.08.12 cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:*
Zbtlink WE2008-DSIM Firmware 23.08.11 cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:*
Zbtlink WE2416 Firmware 21.03.22_1 cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:*
Zbtlink WE3326 Firmware 20.09.30 cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:*
Zbtlink WE5927 Firmware 22.08.10 cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:*
Zbtlink WE5931 Firmware 22.05.31 cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:*
Zbtlink WE5931AC Firmware 22.05.31 cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:*
Zbtlink WE826-T3-DSIM Firmware 21.12.21 cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:*
Zbtlink WG108 Firmware 21.08.06_1 cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:*
Zbtlink WG209 Firmware 21.07.28 cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:*
Zbtlink WG259 Firmware 21.03.23 cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:*
Zbtlink WG1602 Firmware 23.10.11 cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:*
Zbtlink WG1608-DSIM Firmware 23.03.16 cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:*
Zbtlink WG2105 Firmware 22.05.30 cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:*
Zbtlink WG2107 Firmware 22.09.08 cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:*
Zbtlink WG3526 Firmware 22.11.01 cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:*
Zbtlink ZBT-Z8102AX-2SIM Firmware 7.6.7.2-25.0814_114432 cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-66747

# POC Description Source Link Shenlong Link
AI-Generated POC Verified env Premium
Qwen3.6-35B-A3B · 9143 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-66747

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-66747 (1)

Security Blog Posts for CVE-2026-66747 (1)

Other References for CVE-2026-66747 (2)

IV. Related Vulnerabilities

Same vendor: Zbtlink
Same weakness: CWE-506

V. Comments for CVE-2026-66747

No comments yet

Leave a comment