Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities by Zbtlink
CVE-2026-66747 (GCVE-0-2026-66747)
Vulnerability from nvd – Published: 2026-08-05 10:50 – Updated: 2026-08-05 14:20
VLAI
EPSS
VEX
Title
ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant
Summary
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.vulncheck.com/blog/zbt-endlessdoors | technical-descriptionexploit |
| https://www.zbtlink.com/pages/zbt-router-firmware… | product |
| https://github.com/ycsunjane/rctl | |
| https://www.vulncheck.com/advisories/zbt-endlessdoors | third-party-advisory |
Impacted products
20 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zbtlink | CPE2801 Firmware |
Affected:
22.10.09
(custom)
cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE1026-5G-WD Firmware |
Affected:
21.04.07
(custom)
cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE1326 Firmware |
Affected:
22.02.18_1
(custom)
cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2007 Firmware |
Affected:
23.08.12
(custom)
cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2008-DSIM Firmware |
Affected:
23.08.11
(custom)
cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2416 Firmware |
Affected:
21.03.22_1
(custom)
cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE3326 Firmware |
Affected:
20.09.30
(custom)
cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5927 Firmware |
Affected:
22.08.10
(custom)
cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5931 Firmware |
Affected:
22.05.31
(custom)
cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5931AC Firmware |
Affected:
22.05.31
(custom)
cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE826-T3-DSIM Firmware |
Affected:
21.12.21
(custom)
cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG108 Firmware |
Affected:
21.08.06_1
(custom)
cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG209 Firmware |
Affected:
21.07.28
(custom)
cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG259 Firmware |
Affected:
21.03.23
(custom)
cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG1602 Firmware |
Affected:
23.10.11
(custom)
cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG1608-DSIM Firmware |
Affected:
23.03.16
(custom)
cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG2105 Firmware |
Affected:
22.05.30
(custom)
cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG2107 Firmware |
Affected:
22.09.08
(custom)
cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG3526 Firmware |
Affected:
22.11.01
(custom)
cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | ZBT-Z8102AX-2SIM Firmware |
Affected:
7.6.7.2-25.0814_114432
(custom)
cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:* |
Date Public
2026-08-05 00:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66747",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:19:25.533200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:20:12.478Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "CPE2801 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.10.09",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE1026-5G-WD Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.04.07",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE1326 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.02.18_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2007 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.08.12",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2008-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.08.11",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2416 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.03.22_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE3326 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "20.09.30",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5927 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.08.10",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5931 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.31",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5931AC Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.31",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE826-T3-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.12.21",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG108 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.08.06_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG209 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.07.28",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG259 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.03.23",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG1602 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.10.11",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG1608-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.03.16",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG2105 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.30",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG2107 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.09.08",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG3526 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.11.01",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"ARM"
],
"product": "ZBT-Z8102AX-2SIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "7.6.7.2-25.0814_114432",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jacob Baines of VulnCheck"
}
],
"datePublic": "2026-08-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eZbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.\u003c/p\u003e"
}
],
"value": "Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506 Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T10:55:20.206Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "VulnCheck Research Blog",
"tags": [
"technical-description",
"exploit"
],
"url": "https://www.vulncheck.com/blog/zbt-endlessdoors"
},
{
"name": "Vendor Firmware Download Page",
"tags": [
"product"
],
"url": "https://www.zbtlink.com/pages/zbt-router-firmware-download"
},
{
"name": "Upstream Open Source rctl",
"url": "https://github.com/ycsunjane/rctl"
},
{
"name": "VulnCheck Advisory",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zbt-endlessdoors"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-66747",
"datePublished": "2026-08-05T10:50:45.576Z",
"dateReserved": "2026-07-27T16:27:47.648Z",
"dateUpdated": "2026-08-05T14:20:12.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66747 (GCVE-0-2026-66747)
Vulnerability from cvelistv5 – Published: 2026-08-05 10:50 – Updated: 2026-08-05 14:20
VLAI
EPSS
VEX
Title
ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant
Summary
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.vulncheck.com/blog/zbt-endlessdoors | technical-descriptionexploit |
| https://www.zbtlink.com/pages/zbt-router-firmware… | product |
| https://github.com/ycsunjane/rctl | |
| https://www.vulncheck.com/advisories/zbt-endlessdoors | third-party-advisory |
Impacted products
20 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zbtlink | CPE2801 Firmware |
Affected:
22.10.09
(custom)
cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE1026-5G-WD Firmware |
Affected:
21.04.07
(custom)
cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE1326 Firmware |
Affected:
22.02.18_1
(custom)
cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2007 Firmware |
Affected:
23.08.12
(custom)
cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2008-DSIM Firmware |
Affected:
23.08.11
(custom)
cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE2416 Firmware |
Affected:
21.03.22_1
(custom)
cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE3326 Firmware |
Affected:
20.09.30
(custom)
cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5927 Firmware |
Affected:
22.08.10
(custom)
cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5931 Firmware |
Affected:
22.05.31
(custom)
cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE5931AC Firmware |
Affected:
22.05.31
(custom)
cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WE826-T3-DSIM Firmware |
Affected:
21.12.21
(custom)
cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG108 Firmware |
Affected:
21.08.06_1
(custom)
cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG209 Firmware |
Affected:
21.07.28
(custom)
cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG259 Firmware |
Affected:
21.03.23
(custom)
cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG1602 Firmware |
Affected:
23.10.11
(custom)
cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG1608-DSIM Firmware |
Affected:
23.03.16
(custom)
cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG2105 Firmware |
Affected:
22.05.30
(custom)
cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG2107 Firmware |
Affected:
22.09.08
(custom)
cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | WG3526 Firmware |
Affected:
22.11.01
(custom)
cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:* |
|
| Zbtlink | ZBT-Z8102AX-2SIM Firmware |
Affected:
7.6.7.2-25.0814_114432
(custom)
cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:* |
Date Public
2026-08-05 00:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66747",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:19:25.533200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:20:12.478Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "CPE2801 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.10.09",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE1026-5G-WD Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.04.07",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE1326 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.02.18_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2007 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.08.12",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2008-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.08.11",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE2416 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.03.22_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE3326 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "20.09.30",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5927 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.08.10",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5931 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.31",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE5931AC Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.31",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WE826-T3-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.12.21",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG108 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.08.06_1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG209 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.07.28",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG259 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "21.03.23",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG1602 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.10.11",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG1608-DSIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "23.03.16",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG2105 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.05.30",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG2107 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.09.08",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"MIPS",
"ARM"
],
"product": "WG3526 Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "22.11.01",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"ARM"
],
"product": "ZBT-Z8102AX-2SIM Firmware",
"vendor": "Zbtlink",
"versions": [
{
"status": "affected",
"version": "7.6.7.2-25.0814_114432",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jacob Baines of VulnCheck"
}
],
"datePublic": "2026-08-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eZbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.\u003c/p\u003e"
}
],
"value": "Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506 Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T10:55:20.206Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "VulnCheck Research Blog",
"tags": [
"technical-description",
"exploit"
],
"url": "https://www.vulncheck.com/blog/zbt-endlessdoors"
},
{
"name": "Vendor Firmware Download Page",
"tags": [
"product"
],
"url": "https://www.zbtlink.com/pages/zbt-router-firmware-download"
},
{
"name": "Upstream Open Source rctl",
"url": "https://github.com/ycsunjane/rctl"
},
{
"name": "VulnCheck Advisory",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zbt-endlessdoors"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-66747",
"datePublished": "2026-08-05T10:50:45.576Z",
"dateReserved": "2026-07-27T16:27:47.648Z",
"dateUpdated": "2026-08-05T14:20:12.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}