External risk intelligence

ZBTlink Router ENDLESSDOORS Implant grants unauthenticated root access.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-66747

The vulnerable device is a router, a product commonly deployed at the edge of networks to manage internet connectivity. While the vulnerability functions as a phone-home implant rather than a listening service, the device's role as a network gateway and its inherent placement at the internet perimeter makes exposure in common real-world deployments highly probable.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Zbtlink router firmware contains a hidden remote-control implant that operates without encryption or authentication, allowing unauthorized access and remote command execution as a root user. This implant, present in all published builds, communicates with a hardcoded server, and any party intercepting this communication can gain control. The main concern is confirming relevance and exposure of this critical vulnerability.

Hidden implant allows unauthenticated root access.
Devices are internet-facing, increasing exposure risk.
Confirm relevance and assess exposure to this implant.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by intercepting or controlling the hardcoded command-and-control communication channel for the embedded ENDLESSDOORS implant. This implant, running with root privileges on Zbtlink routers, accepts unauthenticated commands sent over cleartext TCP. By successfully communicating with the implant, an attacker can gain the ability to execute arbitrary commands on the router as the root user.

No special access or authentication required.
Attacker controls C2 communication.
Unauthenticated root command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code with root privileges on the affected router. This could occur when the router attempts to contact its hardcoded command and control server, and an attacker is able to intercept or control that communication.

Router system access and control.
Intercepted cleartext communication with C2.
Unauthorized remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The embedded remote-control implant in ZBTlink router firmware necessitates action from infrastructure and security teams. The initial practical step is to inventory all ZBTlink routers, determine their network exposure and business criticality, and identify the accountable owner for each device to prioritize remediation efforts.

Infrastructure and security teams own this.
Verify ZBTlink router inventory and exposure.
Plan phased deployment of vendor firmware updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Zbtlink router firmware?

Zbtlink provides firmware for networking hardware used to manage internet traffic and connectivity. These devices serve as the gateway between local networks and the internet. In this case, the firmware includes a pre-installed, embedded tool designed for remote control called ENDLESSDOORS, which runs as a hidden process on the router's operating system.

What is the security weakness behind CVE-2026-66747?

This CVE involves CWE-506, which refers to embedded malicious code. The vulnerability occurs because the router runs a hidden program that accepts commands from an external source without requiring any password or encryption. Because the system runs this program with root privileges, anyone who can communicate with the device or intercept its connection can remotely run commands with full administrative control over the router.

How does the ENDLESSDOORS implant get triggered?

The implant does not wait for an incoming connection; instead, it automatically attempts to 'phone home' to a hardcoded server every 35 seconds. An attacker triggers the bug by intercepting this cleartext outbound traffic or by masquerading as the intended command server. It is important to note that the vulnerability is not triggered by standard web browsing or routine network traffic, but specifically through the router's autonomous communication channel.

Why is this CVE considered high risk for my network?

Halo Surface Signal notes that because Zbtlink devices function as network gateways at the internet perimeter, they are inherently exposed. Since the implant initiates external connections frequently, your router is actively attempting to communicate with an external server. Even if the router is not hosting public services, its placement at the edge makes it a prime target for intercepting or manipulating the implant's cleartext traffic.

How do I respond to the presence of this implant?

Begin by creating a comprehensive inventory of all Zbtlink routers within your infrastructure to identify which systems are currently deployed. Once identified, evaluate their business role and internet exposure. Engage with your infrastructure team to verify the status of available vendor firmware updates, as replacing or patching the compromised firmware is necessary to remove the unauthorized remote-control capability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.