China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access
- ID
- 18986
- Status
- summarized
- Published
- 28 Aug 2026, 6:58 PM
- Fetched
- 28 Aug 2026, 7:29 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 5.5
- Created
- 28 Aug 2026, 7:33 PM
- Tags
- Audience
- developerssaas_founders
What happened
VulnCheck disclosed two factory-installed backdoors in firmware for routers made by Shenzhen Zhibotong Electronics (ZBT), tracked as CVE-2026-74232 (SPEAKINGSTONE) and CVE-2026-74233 (DARKLANTERN), both rated 9.8 CVSS 3.1. SPEAKINGSTONE beacons to a hardcoded C2 over UDP 10000 and supports root command execution, PPPoE credential exfiltration, DNS hijacking, and reverse SSH tunneling; DARKLANTERN listens on UDP 9992 with a bypassable authentication scheme using a hardcoded salt and all-zero wildcard MAC. VulnCheck found 203 internet-facing DARKLANTERN instances across 22 countries between Aug 18-21, on models including WE1326, WE357, WE5926, WE826-T2, and WG108, traced to an $88 white-labeled unit with 2019 firmware.
Why it matters
If you or your office uses cheap white-labeled ZBT/Zbtlink routers (commonly rebranded and sold under various names in Southeast Asia), assume they are compromised at the firmware level — these are factory implants, not exploits you can patch. Check whether any router in your network exposes UDP 9992 inbound or sends outbound UDP 10000 traffic, and replace affected units with hardware from vendors with auditable firmware supply chains. This is the third such disclosure from VulnCheck on this vendor (following ENDLESSDOORS on Aug 5), indicating a systemic supply-chain problem rather than a one-off bug.
Discussion angle
How to audit your own network for these implants — probing UDP 9992 on your router's WAN IP and checking egress logs for UDP 10000 — and whether cheap white-labeled networking gear from Chinese ODMs is acceptable in any builder's infrastructure stack given this is now the third backdoor disclosure on the same vendor.