Zbtlink Routers Found with Backdoor Named ENDLESSDOORS

Zbtlink routers have been identified with a backdoor named ENDLESSDOORS, which allows remote command execution. This issue was reported by VulnCheck's CTO Jacob Baines, who found the routers continuously attempting to connect to a command and control server. The backdoor is based on a tool called rctl, which was uploaded to GitHub in 2015 and allows for executing commands as root without verification. Zbtlink has denied the existence of backdoors in their firmware but has paused firmware downloads to address unspecified security vulnerabilities. The vulnerability affects multiple router models, and the company claims the feature is for after-sales maintenance, not intended for mass production. CVE-2026-66747 was published on August 5, 2026, highlighting the ongoing security concerns.

Key Points: • Zbtlink routers contain a backdoor named ENDLESSDOORS, allowing remote command execution. • The backdoor utilizes a tool called rctl, which executes commands without verification. • Zbtlink has paused firmware downloads to address security vulnerabilities amid the allegations.