https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 05 Aug 2026 23:36:55 +0000 https://vulnerability.circl.lu/sighting/e2fa9239-3833-46a9-bf35-81606baea952/export {"uuid": "e2fa9239-3833-46a9-bf35-81606baea952", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117044221640947736", "content": "CVE-2026-66747 - Critical RCE via hidden ENDLESSDOORS implant in Zbtlink routers. Backdoor runs as root, phones home over cleartext. CVSS 9.8. Unpatched. Isolate devices now. #CVE #infosec #IoT\nhttps://www.valtersit.com/cve/CVE-2026-66747/", "creation_timestamp": "2026-08-05T18:04:52.303302Z"} {"uuid": "e2fa9239-3833-46a9-bf35-81606baea952", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117044221640947736", "content": "CVE-2026-66747 - Critical RCE via hidden ENDLESSDOORS implant in Zbtlink routers. Backdoor runs as root, phones home over cleartext. CVSS 9.8. Unpatched. Isolate devices now. #CVE #infosec #IoT\nhttps://www.valtersit.com/cve/CVE-2026-66747/", "creation_timestamp": "2026-08-05T18:04:52.303302Z"} https://vulnerability.circl.lu/sighting/e2fa9239-3833-46a9-bf35-81606baea952/export Wed, 05 Aug 2026 18:04:52 +0000 https://vulnerability.circl.lu/sighting/d566dd91-d6d4-43bb-ab87-961f51829cfa/export {"uuid": "d566dd91-d6d4-43bb-ab87-961f51829cfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msdgfvc7v32b", "content": "CVE-2026-66747 - cpe2801 firmware\nThe Zbtlink router has a hidden program that allows an attacker to control the router remotely without a password. This could allow an attacker to make changes to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cpe2801firmware #zbtlink #CVE #infosec", "creation_timestamp": "2026-08-05T11:30:05.453959Z"} {"uuid": "d566dd91-d6d4-43bb-ab87-961f51829cfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msdgfvc7v32b", "content": "CVE-2026-66747 - cpe2801 firmware\nThe Zbtlink router has a hidden program that allows an attacker to control the router remotely without a password. This could allow an attacker to make changes to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cpe2801firmware #zbtlink #CVE #infosec", "creation_timestamp": "2026-08-05T11:30:05.453959Z"} https://vulnerability.circl.lu/sighting/d566dd91-d6d4-43bb-ab87-961f51829cfa/export Wed, 05 Aug 2026 11:30:05 +0000 https://vulnerability.circl.lu/sighting/1fbbcd10-334c-475c-8d82-95f936fea9e9/export {"uuid": "1fbbcd10-334c-475c-8d82-95f936fea9e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://infosec.exchange/users/catc0n/statuses/117042451920559868", "content": "Today, VulnCheck is disclosing #ENDLESSDOORS, a phone-home implant CTO @albinolobster discovered in Zbtlink routers. ENDLESSDOORS starts automatically, runs with root privileges, and attempts to connect to command-and-control infrastructure roughly every 35 seconds. The backdoor ships by default across 20+ Zbtlink router models, which are white-labeled and sold on popular retail sites including Amazon, AliExpress, and Alibaba.\nThe implant and server implement no encryption or verification, meaning anyone along the network path can hijack the client-server communication and obtain a root shell on the device, regardless of the router's network position. \nThe VulnCheck CNA has assigned CVE-2026-66747 to track backdoored firmware versions; our blog also has guidance for defenders, including affected firmware images, hashes, network indicators, a YARA rule, and network signatures (Suricata / Snort).\nhttps://www.vulncheck.com/blog/zbt-endlessdoors", "creation_timestamp": "2026-08-05T10:34:46.528224Z"} {"uuid": "1fbbcd10-334c-475c-8d82-95f936fea9e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://infosec.exchange/users/catc0n/statuses/117042451920559868", "content": "Today, VulnCheck is disclosing #ENDLESSDOORS, a phone-home implant CTO @albinolobster discovered in Zbtlink routers. ENDLESSDOORS starts automatically, runs with root privileges, and attempts to connect to command-and-control infrastructure roughly every 35 seconds. The backdoor ships by default across 20+ Zbtlink router models, which are white-labeled and sold on popular retail sites including Amazon, AliExpress, and Alibaba.\nThe implant and server implement no encryption or verification, meaning anyone along the network path can hijack the client-server communication and obtain a root shell on the device, regardless of the router's network position. \nThe VulnCheck CNA has assigned CVE-2026-66747 to track backdoored firmware versions; our blog also has guidance for defenders, including affected firmware images, hashes, network indicators, a YARA rule, and network signatures (Suricata / Snort).\nhttps://www.vulncheck.com/blog/zbt-endlessdoors", "creation_timestamp": "2026-08-05T10:34:46.528224Z"} https://vulnerability.circl.lu/sighting/1fbbcd10-334c-475c-8d82-95f936fea9e9/export Wed, 05 Aug 2026 10:34:46 +0000