Factory Implants in White-Labeled ZBT Routers Expose Thousands of Devices to Unauthenticated Remote Root

Security researchers at VulnCheck discovered two undocumented factory-installed implants running inside firmware produced by Shenzhen Zhibotong Electronics (ZBT). Tracked as CVE-2026-74232 and CVE-2026-74233, both vulnerabilities allow unauthenticated remote attackers to execute arbitrary shell commands with root privileges. The first backdoor, dubbed SPEAKINGSTONE, operates as a daemon named `yunmgrd` and periodically dials out to command-and-control servers via UDP port 10000. Because it initiates outbound traffic, SPEAKINGSTONE cleanly bypasses local NAT and egress filtering to enable DNS hijacking, PPPoE credential theft, and reverse SSH tunnels. When researchers sinkholed its hardcoded backup domain, nearly 400 unique devices immediately beaconed in, representing only a fraction of affected deployments. The second implant, DARKLANTERN, runs as `infosrvd` on UDP port 9992 with an open stock firewall rule accepting inbound WAN connections. Authentication on `infosrvd` is fundamentally broken, relying on a static salt and a wildcard MAC address bypass. Internet-wide scans discovered at least 203 exposed DARKLANTERN instances across 22 countries spanning dozens of hardware models. These flaws follow an earlier backdoor found in ZBT hardware, designated ENDLESSDOORS (CVE-2026-66747). Because ZBT acts as an OEM for numerous white-label brands, identifying impacted hardware requires inspecting MAC address prefixes like `78:A3:51` and `F8:5E:3C` rather than the vendor branding on the chassis.