ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant
Priority HIGH 81CWE-506Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-506.
Summary
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00789 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Zbtlink | CPE2801 Firmware | 22.10.09 | — | No fix listed | CNA |
| Zbtlink | WE1026-5G-WD Firmware | 21.04.07 | — | No fix listed | CNA |
| Zbtlink | WE1326 Firmware | 22.02.18_1 | — | No fix listed | CNA |
| Zbtlink | WE2007 Firmware | 23.08.12 | — | No fix listed | CNA |
| Zbtlink | WE2008-DSIM Firmware | 23.08.11 | — | No fix listed | CNA |
| Zbtlink | WE2416 Firmware | 21.03.22_1 | — | No fix listed | CNA |
| Zbtlink | WE3326 Firmware | 20.09.30 | — | No fix listed | CNA |
| Zbtlink | WE5927 Firmware | 22.08.10 | — | No fix listed | CNA |
| Zbtlink | WE5931 Firmware | 22.05.31 | — | No fix listed | CNA |
| Zbtlink | WE5931AC Firmware | 22.05.31 | — | No fix listed | CNA |
| Zbtlink | WE826-T3-DSIM Firmware | 21.12.21 | — | No fix listed | CNA |
| Zbtlink | WG108 Firmware | 21.08.06_1 | — | No fix listed | CNA |
| Zbtlink | WG209 Firmware | 21.07.28 | — | No fix listed | CNA |
| Zbtlink | WG259 Firmware | 21.03.23 | — | No fix listed | CNA |
| Zbtlink | WG1602 Firmware | 23.10.11 | — | No fix listed | CNA |
| Zbtlink | WG1608-DSIM Firmware | 23.03.16 | — | No fix listed | CNA |
| Zbtlink | WG2105 Firmware | 22.05.30 | — | No fix listed | CNA |
| Zbtlink | WG2107 Firmware | 22.09.08 | — | No fix listed | CNA |
| Zbtlink | WG3526 Firmware | 22.11.01 | — | No fix listed | CNA |
| Zbtlink | ZBT-Z8102AX-2SIM Firmware | 7.6.7.2-25.0814_114432 | — | No fix listed | CNA |
- CPE2801 Firmware VendorZbtlink Affected 22.10.09 Fixed in — No fix listed CNA
- WE1026-5G-WD Firmware VendorZbtlink Affected 21.04.07 Fixed in — No fix listed CNA
- WE1326 Firmware VendorZbtlink Affected 22.02.18_1 Fixed in — No fix listed CNA
- WE2007 Firmware VendorZbtlink Affected 23.08.12 Fixed in — No fix listed CNA
- WE2008-DSIM Firmware VendorZbtlink Affected 23.08.11 Fixed in — No fix listed CNA
- WE2416 Firmware VendorZbtlink Affected 21.03.22_1 Fixed in — No fix listed CNA
- WE3326 Firmware VendorZbtlink Affected 20.09.30 Fixed in — No fix listed CNA
- WE5927 Firmware VendorZbtlink Affected 22.08.10 Fixed in — No fix listed CNA
- WE5931 Firmware VendorZbtlink Affected 22.05.31 Fixed in — No fix listed CNA
- WE5931AC Firmware VendorZbtlink Affected 22.05.31 Fixed in — No fix listed CNA
- WE826-T3-DSIM Firmware VendorZbtlink Affected 21.12.21 Fixed in — No fix listed CNA
- WG108 Firmware VendorZbtlink Affected 21.08.06_1 Fixed in — No fix listed CNA
- WG209 Firmware VendorZbtlink Affected 21.07.28 Fixed in — No fix listed CNA
- WG259 Firmware VendorZbtlink Affected 21.03.23 Fixed in — No fix listed CNA
- WG1602 Firmware VendorZbtlink Affected 23.10.11 Fixed in — No fix listed CNA
- WG1608-DSIM Firmware VendorZbtlink Affected 23.03.16 Fixed in — No fix listed CNA
- WG2105 Firmware VendorZbtlink Affected 22.05.30 Fixed in — No fix listed CNA
- WG2107 Firmware VendorZbtlink Affected 22.09.08 Fixed in — No fix listed CNA
- WG3526 Firmware VendorZbtlink Affected 22.11.01 Fixed in — No fix listed CNA
- ZBT-Z8102AX-2SIM Firmware VendorZbtlink Affected 7.6.7.2-25.0814_114432 Fixed in — No fix listed CNA
CPE names CNA · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
- cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
| cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:* | — | — | Zbtlink |
- cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
- cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:* Versions — — ·Zbtlink
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-66747
- 2026-10-03 Alias added: GHSA-gf5q-q6h6-j87v
References
More Zbtlink vulnerabilities
- TI-2026-52021 Zbtlink MQWrt infosrvd Command Injection CVSS 4.0CRITICAL 9.3
- TI-2026-52020 Zbtlink MQWrt yunmgrd Cloud C2 Implant CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-66747 · CVE Program
- CVE-2026-66747 · NVD
- FIRST EPSS
- GHSA-gf5q-q6h6-j87v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences