https://vulnerability.circl.lu/sightings/feed 2026-08-06T13:08:45.684799+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/e2fa9239-3833-46a9-bf35-81606baea952/export 2026-08-06T13:08:45.700258+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "e2fa9239-3833-46a9-bf35-81606baea952", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117044221640947736", "content": "CVE-2026-66747 - Critical RCE via hidden ENDLESSDOORS implant in Zbtlink routers. Backdoor runs as root, phones home over cleartext. CVSS 9.8. Unpatched. Isolate devices now. #CVE #infosec #IoT\nhttps://www.valtersit.com/cve/CVE-2026-66747/", "creation_timestamp": "2026-08-05T18:04:52.303302Z"} 2026-08-05T18:04:52.303302+00:00 https://vulnerability.circl.lu/sighting/d566dd91-d6d4-43bb-ab87-961f51829cfa/export 2026-08-06T13:08:45.703254+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "d566dd91-d6d4-43bb-ab87-961f51829cfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msdgfvc7v32b", "content": "CVE-2026-66747 - cpe2801 firmware\nThe Zbtlink router has a hidden program that allows an attacker to control the router remotely without a password. This could allow an attacker to make changes to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cpe2801firmware #zbtlink #CVE #infosec", "creation_timestamp": "2026-08-05T11:30:05.453959Z"} 2026-08-05T11:30:05.453959+00:00 https://vulnerability.circl.lu/sighting/1fbbcd10-334c-475c-8d82-95f936fea9e9/export 2026-08-06T13:08:45.703596+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1fbbcd10-334c-475c-8d82-95f936fea9e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://infosec.exchange/users/catc0n/statuses/117042451920559868", "content": "Today, VulnCheck is disclosing #ENDLESSDOORS, a phone-home implant CTO @albinolobster discovered in Zbtlink routers. ENDLESSDOORS starts automatically, runs with root privileges, and attempts to connect to command-and-control infrastructure roughly every 35 seconds. The backdoor ships by default across 20+ Zbtlink router models, which are white-labeled and sold on popular retail sites including Amazon, AliExpress, and Alibaba.\nThe implant and server implement no encryption or verification, meaning anyone along the network path can hijack the client-server communication and obtain a root shell on the device, regardless of the router's network position. \nThe VulnCheck CNA has assigned CVE-2026-66747 to track backdoored firmware versions; our blog also has guidance for defenders, including affected firmware images, hashes, network indicators, a YARA rule, and network signatures (Suricata / Snort).\nhttps://www.vulncheck.com/blog/zbt-endlessdoors", "creation_timestamp": "2026-08-05T10:34:46.528224Z"} 2026-08-05T10:34:46.528224+00:00