Vulnerability-Lookup

CVE-2026-66747 (GCVE-0-2026-66747)

Vulnerability from cvelistv5 – Published: 2026-08-05 10:50 – Updated: 2026-08-05 14:20

Title

ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant

Summary

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-506 - Embedded Malicious Code

Assigner

VulnCheck

References

4 references

URL	Tags
https://www.vulncheck.com/blog/zbt-endlessdoors	technical-descriptionexploit
https://www.zbtlink.com/pages/zbt-router-firmware…	product
https://github.com/ycsunjane/rctl
https://www.vulncheck.com/advisories/zbt-endlessdoors	third-party-advisory

Impacted products

20 products

Vendor	Product	Version
Zbtlink	CPE2801 Firmware	Affected: 22.10.09 (custom) cpe:2.3:o:zbtlink:cpe2801_firmware::::::::
Zbtlink	WE1026-5G-WD Firmware	Affected: 21.04.07 (custom) cpe:2.3:o:zbtlink:we1026-5g-wd_firmware::::::::
Zbtlink	WE1326 Firmware	Affected: 22.02.18_1 (custom) cpe:2.3:o:zbtlink:we1326_firmware::::::::
Zbtlink	WE2007 Firmware	Affected: 23.08.12 (custom) cpe:2.3:o:zbtlink:we2007_firmware::::::::
Zbtlink	WE2008-DSIM Firmware	Affected: 23.08.11 (custom) cpe:2.3:o:zbtlink:we2008-dsim_firmware::::::::
Zbtlink	WE2416 Firmware	Affected: 21.03.22_1 (custom) cpe:2.3:o:zbtlink:we2416_firmware::::::::
Zbtlink	WE3326 Firmware	Affected: 20.09.30 (custom) cpe:2.3:o:zbtlink:we3326_firmware::::::::
Zbtlink	WE5927 Firmware	Affected: 22.08.10 (custom) cpe:2.3:o:zbtlink:we5927_firmware::::::::
Zbtlink	WE5931 Firmware	Affected: 22.05.31 (custom) cpe:2.3:o:zbtlink:we5931_firmware::::::::
Zbtlink	WE5931AC Firmware	Affected: 22.05.31 (custom) cpe:2.3:o:zbtlink:we5931ac_firmware::::::::
Zbtlink	WE826-T3-DSIM Firmware	Affected: 21.12.21 (custom) cpe:2.3:o:zbtlink:we826-t3-dsim_firmware::::::::
Zbtlink	WG108 Firmware	Affected: 21.08.06_1 (custom) cpe:2.3:o:zbtlink:wg108_firmware::::::::
Zbtlink	WG209 Firmware	Affected: 21.07.28 (custom) cpe:2.3:o:zbtlink:wg209_firmware::::::::
Zbtlink	WG259 Firmware	Affected: 21.03.23 (custom) cpe:2.3:o:zbtlink:wg259_firmware::::::::
Zbtlink	WG1602 Firmware	Affected: 23.10.11 (custom) cpe:2.3:o:zbtlink:wg1602_firmware::::::::
Zbtlink	WG1608-DSIM Firmware	Affected: 23.03.16 (custom) cpe:2.3:o:zbtlink:wg1608-dsim_firmware::::::::
Zbtlink	WG2105 Firmware	Affected: 22.05.30 (custom) cpe:2.3:o:zbtlink:wg2105_firmware::::::::
Zbtlink	WG2107 Firmware	Affected: 22.09.08 (custom) cpe:2.3:o:zbtlink:wg2107_firmware::::::::
Zbtlink	WG3526 Firmware	Affected: 22.11.01 (custom) cpe:2.3:o:zbtlink:wg3526_firmware::::::::
Zbtlink	ZBT-Z8102AX-2SIM Firmware	Affected: 7.6.7.2-25.0814_114432 (custom) cpe:2.3:o:zbtlink:z8102ax_firmware::::::::

Date Public

2026-08-05 00:00

Credits

Jacob Baines of VulnCheck

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66747",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T14:19:25.533200Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T14:20:12.478Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "CPE2801 Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "22.10.09",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WE1026-5G-WD Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "21.04.07",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WE1326 Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "22.02.18_1",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WE2007 Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "23.08.12",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WE2008-DSIM Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "23.08.11",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WE2416 Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "21.03.22_1",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WE3326 Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "20.09.30",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WE5927 Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "22.08.10",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WE5931 Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "22.05.31",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WE5931AC Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "22.05.31",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WE826-T3-DSIM Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "21.12.21",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WG108 Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "21.08.06_1",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WG209 Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "21.07.28",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WG259 Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "21.03.23",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WG1602 Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "23.10.11",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WG1608-DSIM Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "23.03.16",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WG2105 Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "22.05.30",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WG2107 Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "22.09.08",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MIPS",
            "ARM"
          ],
          "product": "WG3526 Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "22.11.01",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "ARM"
          ],
          "product": "ZBT-Z8102AX-2SIM Firmware",
          "vendor": "Zbtlink",
          "versions": [
            {
              "status": "affected",
              "version": "7.6.7.2-25.0814_114432",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jacob Baines of VulnCheck"
        }
      ],
      "datePublic": "2026-08-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eZbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.\u003c/p\u003e"
            }
          ],
          "value": "Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-506",
              "description": "CWE-506 Embedded Malicious Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T10:55:20.206Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "VulnCheck Research Blog",
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://www.vulncheck.com/blog/zbt-endlessdoors"
        },
        {
          "name": "Vendor Firmware Download Page",
          "tags": [
            "product"
          ],
          "url": "https://www.zbtlink.com/pages/zbt-router-firmware-download"
        },
        {
          "name": "Upstream Open Source rctl",
          "url": "https://github.com/ycsunjane/rctl"
        },
        {
          "name": "VulnCheck Advisory",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zbt-endlessdoors"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-66747",
    "datePublished": "2026-08-05T10:50:45.576Z",
    "dateReserved": "2026-07-27T16:27:47.648Z",
    "dateUpdated": "2026-08-05T14:20:12.478Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-66747\",\"sourceIdentifier\":\"disclosure@vulncheck.com\",\"published\":\"2026-08-05T11:16:25.510\",\"lastModified\":\"2026-08-05T15:17:04.690\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.\"}],\"affected\":[{\"source\":\"disclosure@vulncheck.com\",\"affectedData\":[{\"vendor\":\"Zbtlink\",\"product\":\"CPE2801 Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"22.10.09\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WE1026-5G-WD Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"21.04.07\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WE1326 Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"22.02.18_1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WE2007 Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"23.08.12\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WE2008-DSIM Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"23.08.11\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WE2416 Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"21.03.22_1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WE3326 Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"20.09.30\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WE5927 Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"22.08.10\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WE5931 Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"22.05.31\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WE5931AC Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"22.05.31\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WE826-T3-DSIM Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"21.12.21\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WG108 Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"21.08.06_1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WG209 Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"21.07.28\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WG259 Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"21.03.23\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WG1602 Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"23.10.11\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WG1608-DSIM Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"23.03.16\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WG2105 Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"22.05.30\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WG2107 Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"22.09.08\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"WG3526 Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"MIPS\",\"ARM\"],\"versions\":[{\"version\":\"22.11.01\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Zbtlink\",\"product\":\"ZBT-Z8102AX-2SIM Firmware\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:*\"],\"platforms\":[\"ARM\"],\"versions\":[{\"version\":\"7.6.7.2-25.0814_114432\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-05T14:19:25.533200Z\",\"id\":\"CVE-2026-66747\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-506\"}]}],\"references\":[{\"url\":\"https://github.com/ycsunjane/rctl\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://www.vulncheck.com/advisories/zbt-endlessdoors\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://www.vulncheck.com/blog/zbt-endlessdoors\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://www.zbtlink.com/pages/zbt-router-firmware-download\",\"source\":\"disclosure@vulncheck.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-66747\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-05T14:19:25.533200Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-05T14:20:07.830Z\"}}], \"cna\": {\"title\": \"ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Jacob Baines of VulnCheck\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 9.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"CPE2801 Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"22.10.09\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WE1026-5G-WD Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.04.07\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WE1326 Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"22.02.18_1\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WE2007 Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"23.08.12\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WE2008-DSIM Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"23.08.11\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WE2416 Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.03.22_1\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WE3326 Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"20.09.30\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WE5927 Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"22.08.10\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WE5931 Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"22.05.31\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WE5931AC Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"22.05.31\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WE826-T3-DSIM Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.12.21\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WG108 Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.08.06_1\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WG209 Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.07.28\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WG259 Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.03.23\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WG1602 Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"23.10.11\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WG1608-DSIM Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"23.03.16\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WG2105 Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"22.05.30\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WG2107 Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"22.09.08\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"WG3526 Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"22.11.01\", \"versionType\": \"custom\"}], \"platforms\": [\"MIPS\", \"ARM\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"Zbtlink\", \"product\": \"ZBT-Z8102AX-2SIM Firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.6.7.2-25.0814_114432\", \"versionType\": \"custom\"}], \"platforms\": [\"ARM\"], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-08-05T00:00:00.000Z\", \"references\": [{\"url\": \"https://www.vulncheck.com/blog/zbt-endlessdoors\", \"name\": \"VulnCheck Research Blog\", \"tags\": [\"technical-description\", \"exploit\"]}, {\"url\": \"https://www.zbtlink.com/pages/zbt-router-firmware-download\", \"name\": \"Vendor Firmware Download Page\", \"tags\": [\"product\"]}, {\"url\": \"https://github.com/ycsunjane/rctl\", \"name\": \"Upstream Open Source rctl\"}, {\"url\": \"https://www.vulncheck.com/advisories/zbt-endlessdoors\", \"name\": \"VulnCheck Advisory\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"vulncheck\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eZbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-506\", \"description\": \"CWE-506 Embedded Malicious Code\"}]}], \"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2026-08-05T10:55:20.206Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-66747\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T14:20:12.478Z\", \"dateReserved\": \"2026-07-27T16:27:47.648Z\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"datePublished\": \"2026-08-05T10:50:45.576Z\", \"assignerShortName\": \"VulnCheck\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-GF5Q-Q6H6-J87V

Vulnerability from github – Published: 2026-08-05 12:31 – Updated: 2026-08-05 12:31

Details

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-66747"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-506"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-05T11:16:25Z",
    "severity": "CRITICAL"
  },
  "details": "Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.",
  "id": "GHSA-gf5q-q6h6-j87v",
  "modified": "2026-08-05T12:31:30Z",
  "published": "2026-08-05T12:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66747"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ycsunjane/rctl"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/zbt-endlessdoors"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/blog/zbt-endlessdoors"
    },
    {
      "type": "WEB",
      "url": "https://www.zbtlink.com/pages/zbt-router-firmware-download"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-66747 (GCVE-0-2026-66747)

GHSA-GF5Q-Q6H6-J87V

Tags

Sightings

Nomenclature