{"id":"CVE-2026-66747","title":"Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line","summary":"Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at b…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-506"],"vendor":"Zbtlink","product":"CPE2801 Firmware","affected":["cpe2801_firmware 22.10.09","we1026-5g-wd_firmware 21.04.07","we1326_firmware 22.02.18_1","we2007_firmware 23.08.12","we2008-dsim_firmware 23.08.11","we2416_firmware 21.03.22_1","we3326_firmware 20.09.30","we5927_firmware 22.08.10","we5931_firmware 22.05.31","we5931ac_firmware 22.05.31","we826-t3-dsim_firmware 21.12.21","wg108_firmware 21.08.06_1","wg209_firmware 21.07.28","wg259_firmware 21.03.23","wg1602_firmware 23.10.11","wg1608-dsim_firmware 23.03.16","wg2105_firmware 22.05.30","wg2107_firmware 22.09.08","wg3526_firmware 22.11.01","zbt-z8102ax-2sim_firmware 7.6.7.2-25.0814_114432"],"published":"2026-08-05","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:35:08.537","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-66747","references":[{"url":"https://github.com/ycsunjane/rctl","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/zbt-endlessdoors","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/blog/zbt-endlessdoors","label":"disclosure@vulncheck.com"},{"url":"https://www.zbtlink.com/pages/zbt-router-firmware-download","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-08-05T14:19:25.533200Z"},"ingestedAt":"2026-09-13T02:35:51.191Z","epss":0.00658,"epssPercentile":0.49695,"exploits":{"github":1,"githubRepos":["https://github.com/oiehnow/oieh-router-checker"],"checkedAt":"2026-09-21T15:30:11.095Z"},"slug":"CVE-2026-66747","body":"## Overview\n\nZbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}