{"id":2592,"date":"2026-08-28T15:04:29","date_gmt":"2026-08-28T15:04:29","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2592"},"modified":"2026-08-28T15:04:29","modified_gmt":"2026-08-28T15:04:29","slug":"china-made-zbt-routers-ship-with-two-implants-giving-unauthenticated-attackers-root-access","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2592","title":{"rendered":"China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access"},"content":{"rendered":"
\n
<\/a><\/div>\n

VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT<\/b>), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.<\/p>\n

The implants, named SPEAKINGSTONE<\/b> and DARKLANTERN <\/b>by the company’s zero-day research team, are tracked as CVE-2026-74232<\/b> and CVE-2026-74233<\/b>.<\/p>\n

VulnCheck, which assigned both identifiers as a CVE Numbering Authority (CNA), rated each 9.3 on the CVSS 4.0 scoring system and 9.8 on CVSS 3.1. Both vectors record a network attack requiring no privileges and no user interaction.<\/p>\n

SPEAKINGSTONE, which runs as the service yunmgrd<\/code>, sends beacons over UDP port 10000 to a hardcoded command-and-control (C2) server. Because the implant dials outward, it functions from behind NAT and ordinary egress filtering.<\/p>\n

Its protocol supports message types that execute arbitrary commands as root, exfiltrate the WAN PPPoE username and password, write and read a DNS hijack list, and open a reverse SSH tunnel.<\/p>\n

\u00abThis is a surveillance implant with root access to every device it runs on,\u00bb VulnCheck said in its supply chain research<\/a>.<\/p>\n

DARKLANTERN operates as the service infosrvd<\/code> on UDP port 9992, which the router’s stock firewall opens to inbound connections from any internet address. VulnCheck’s advisory describes the service’s authentication as ineffective, resting on a hardcoded salt and an all-zero wildcard MAC value that bypasses its own address check.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Between August 18 and August 21, VulnCheck identified 203 internet-facing DARKLANTERN instances across 22 countries, self-reporting 16 distinct models. The figure counts hosts that answered a probe rather than devices found compromised.<\/p>\n

Both implants were found on an $88 Deep Orange 3G\/4G\/LTE Router bought from a U.S. supplier, a white-labeled ZBT-WE826-T2 whose firmware was built in 2019. That unit predates ENDLESSDOORS (CVE-2026-66747), the phone-home implant VulnCheck disclosed on August 5 and found in at least 20 Zbtlink router models.<\/p>\n

VulnCheck’s advisory for the DARKLANTERN command injection<\/a> and its advisory for the SPEAKINGSTONE C2 implant<\/a> name the following models and firmware builds –<\/p>\n