---
id: CVE-2026-66747
title: >-
  Zbtlink router firmware ships an embedded remote-control implant,
  ENDLESSDOORS, present in every published build across the product line
summary: >-
  Zbtlink router firmware ships an embedded remote-control implant,
  ENDLESSDOORS, present in every published build across the product line. It is
  the open-source ycsunjane/rctl tool built in as an OpenWrt package
  (librctl.so), started at b…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-506
vendor: Zbtlink
product: CPE2801 Firmware
affected:
  - cpe2801_firmware 22.10.09
  - we1026-5g-wd_firmware 21.04.07
  - we1326_firmware 22.02.18_1
  - we2007_firmware 23.08.12
  - we2008-dsim_firmware 23.08.11
  - we2416_firmware 21.03.22_1
  - we3326_firmware 20.09.30
  - we5927_firmware 22.08.10
  - we5931_firmware 22.05.31
  - we5931ac_firmware 22.05.31
  - we826-t3-dsim_firmware 21.12.21
  - wg108_firmware 21.08.06_1
  - wg209_firmware 21.07.28
  - wg259_firmware 21.03.23
  - wg1602_firmware 23.10.11
  - wg1608-dsim_firmware 23.03.16
  - wg2105_firmware 22.05.30
  - wg2107_firmware 22.09.08
  - wg3526_firmware 22.11.01
  - zbt-z8102ax-2sim_firmware 7.6.7.2-25.0814_114432
published: '2026-08-05'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:35:08.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66747'
references:
  - url: 'https://github.com/ycsunjane/rctl'
    label: disclosure@vulncheck.com
  - url: 'https://www.vulncheck.com/advisories/zbt-endlessdoors'
    label: disclosure@vulncheck.com
  - url: 'https://www.vulncheck.com/blog/zbt-endlessdoors'
    label: disclosure@vulncheck.com
  - url: 'https://www.zbtlink.com/pages/zbt-router-firmware-download'
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-05T14:19:25.533200Z'
ingestedAt: '2026-09-13T02:35:51.191Z'
epss: 0.00658
epssPercentile: 0.49695
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/oiehnow/oieh-router-checker'
  checkedAt: '2026-09-21T15:30:11.095Z'
---

## Overview

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.