EUVD-2026-53301
GHSA-gf5q-q6h6-j87v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated cleartext C2 yields root command execution once the attacker controls the rendezvous (acquiring a lapsed hardcoded domain is trivial, so AC:L, PR:N); full C/I/A loss on the device, no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.
AnalysisAI
Backdoored firmware in Zbtlink routers ships ENDLESSDOORS, an embedded implant (librctl.so, based on the open-source ycsunjane/rctl tool) present in every published build across the product line, granting unauthenticated remote root code execution. Started at boot as root and masquerading as a kernel [kworker/*] thread, it beacons every ~35 seconds over cleartext, unauthenticated TCP to a hardcoded command-and-control server, passing any received command to popen() as uid=0 and offering an interactive root shell via a reserved 'rctlbash' command. Because the channel has no authentication or encryption, control is not restricted to whoever planted it - anyone who answers at the C2 address, hijacks the network path (DNS/route), or registers the hardcoded fallback domain obtains root; no public exploit is identified in the input and there is no CISA KEV listing, though the underlying rctl tooling is publicly available open-source code.
Technical ContextAI
The implant is a compiled OpenWrt package (librctl.so) derived from ycsunjane/rctl, a publicly available open-source remote-control utility, embedded directly into the vendor's firmware images rather than introduced post-compromise. It runs as PID with root privileges under the deliberately deceptive process name 'kworker' to blend in with legitimate kernel worker threads ([kworker/*]), an anti-forensic naming choice. Rather than binding a listening socket (which port scans would reveal), it uses an outbound beaconing model: cleartext TCP callbacks to a hardcoded C2 host on port 7000 (command channel) and 7001 (interactive-shell callback), retried roughly every 35 seconds. The command handler executes arbitrary received strings through popen() as uid=0. This maps to CWE-506 (Embedded Malicious Code) - the root cause is not a memory-safety or input-validation bug but intentional/backdoor functionality shipped in the supply chain, meaning the vulnerable component is the firmware distribution itself.
RemediationAI
No vendor-released patched firmware version is identified at time of analysis, so treat every deployed Zbtlink build as compromised until the vendor publishes a verified clean image via https://www.zbtlink.com/pages/zbt-router-firmware-download and confirm any replacement no longer contains librctl.so or the kworker-named process. As immediate compensating controls: block and alert on all outbound TCP to the hardcoded C2 host and ports 7000/7001 at an upstream firewall (side effect: only stops the specific channel and can be bypassed if the attacker moves C2, so pair with egress default-deny); enforce strict outbound egress filtering so the router cannot reach arbitrary internet hosts (side effect: may break legitimate vendor update/NTP/telemetry traffic - allowlist those explicitly); sinkhole or override the hardcoded fallback domain in local DNS to prevent a third party who registers it from gaining control (side effect: requires knowing the exact domain from the VulnCheck advisory); and inspect running processes for a root-owned 'kworker' that is not a genuine kernel thread. Given a persistent root implant, the safest remediation for high-assurance environments is to retire or replace the affected hardware, since firmware-resident backdoors can survive reflashing if the malicious package is re-included. Consult https://www.vulncheck.com/advisories/zbt-endlessdoors for the exact C2 indicators to build these controls.
Same weakness CWE-506 – Embedded Malicious Code
View allShare
External POC / Exploit Code
Leaving vuln.today