According to a VulnCheck advisory published 2026-08-05, every published Zbtlink router firmware build across the product line contains ENDLESSDOORS, an embedded remote-control implant that VulnCheck reports runs as root and grants unauthenticated remote code execution to anyone who can answer its command-and-control channel. The advisory assigns it a CVSS 9.8 (Critical) score. The findings come from a single source and have not been independently corroborated in the material available at publication time.
What Is It
CVE-2026-66747 covers what VulnCheck characterizes as an implant that Zbtlink ships in its own firmware, not an attacker-planted payload. According to the advisory, ENDLESSDOORS is the open-source ycsunjane/rctl tool compiled in as an OpenWrt package (librctl.so). VulnCheck reports that it starts at boot, runs as root, and disguises itself under the process name kworker to blend in with the kernel's [kworker/*] threads.
The advisory states the implant opens no listening port. Instead it is described as phoning home over cleartext TCP to a hardcoded C2 server, command channel on port 7000, interactive-shell callback on 7001, retrying roughly every 35 seconds, with no authentication and no transport encryption. Per VulnCheck's analysis, its command handler passes any received string straight to popen() as uid=0, and a reserved rctlbash command hands back an interactive root shell.
Why It Matters
If the channel is unauthenticated and cleartext as described, control would not be limited to whoever built it in. Any party that answers at the C2 address, occupies the network path via DNS or route hijack, or acquires the hardcoded fallback domain would obtain unauthenticated remote code execution as root. The CVSS 3.1 vector assigned in the advisory, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflects a network-reachable, no-privilege, no-interaction path to full device compromise. These are edge devices; a root shell on one is a foothold on everything behind it.
What's Vulnerable
The advisory describes the implant as present in every published build across the Zbtlink product line, on both MIPS and ARM platforms. Named affected firmware includes CPE2801 (22.10.09), WE1026-5G-WD (21.04.07), WE1326 (22.02.18_1), WE2007 (23.08.12), WE2008-DSIM (23.08.11), WE2416 (21.03.22_1), WE3326 (20.09.30), WE5927 (22.08.10), WE5931 and WE5931AC (22.05.31), WE826-T3-DSIM (21.12.21), WG108 (21.08.06_1), WG209 (21.07.28), WG259 (21.03.23), WG1602 (23.10.11), and WG1608-DSIM. This list reflects the vendor-independent researcher assessment in the advisory; Zbtlink has not published a confirmation or denial in the material reviewed.
Patch Status
The NVD record is in Received status, published 2026-08-05 by VulnCheck, with no fixed version identified in the supplied data. Received status means the entry has not yet been analyzed or enriched by NVD staff, so the scoring and affected-product data reflect the reporting source rather than an independent NVD assessment. No CISA KEV entry was supplied for this CVE, so there is no KEV-confirmed active exploitation or KEV required-action deadline to report at this time.