Researchers uncover three backdoor implants in ZBT routers
VulnCheck discovered three backdoor-like implants in firmware for routers made by Shenzhen Zhibotong Electronics, which are sold under many brands globally. One implant, dubbed ENDLESSDOORS, can execute arbitrary commands as root and automatically connects to a command-and-control server. The vulnerability carries a CVSS score of 9.3 and affects at least 20 router models.
Expanded Detail
EXPANDED:
The implants operate across different attack surfaces. ENDLESSDOORS activates at boot, masquerading as a kernel process while maintaining persistent contact with a hardcoded server, and VulnCheck proved takeover was possible by spoofing that server. DARKLANTERN, found in older 2019 firmware, listens on UDP port 9992 and responds to a fixed 19-byte probe, with
Expanded detail and Context are AI-generated analysis; the linked article remains the authoritative source.
This summary is Al-enhanced to contain extended analysis and broader social context. The original is {NAME); the linked article is the authoritative source. Original headline: “Security researchers find surveillance implants in Chinese-made routers sold worldwide — three different backdoor-like implants hidden in firmware.” Browse more stories.