A hidden backdoor in 20 router models lets remote servers execute commands as root, putting affected devices at risk of takeover.

Jacob Baines had a router on his desk that kept trying to call home, and it wasn’t supposed to. VulnCheck researchers found a backdoor baked into Zbtlink routers, and it’s not the kind of flaw you patch with an update. It’s a feature the vendor built in on purpose and shipped anyway.

Zbtlink is a Chinese manufacturer, Shenzhen Zhibotong Electronics, that builds routers and white-labels them under names like Wiflyer, ZBT, and ZBTWiFi, selling the same hardware on Amazon, Alibaba, and Shopify. The researchers bought a Zbtlink AX3000 off Alibaba and found something hiding in the process list disguised as a kernel thread.

Two processes named “kworker” were running as root with real memory footprints, sitting right next to the legitimate kernel threads that share the same name, betting nobody would look twice.

Those two processes are what Baines calls ENDLESSDOORS, built around a tiny open-source tool called rctl that nobody had touched since it was uploaded to GitHub back in 2015.

“A kworker is a Linux kernel thread, and it shows up in a process listing wrapped in brackets. The two unbracketed kworkers in the snippet above, from our AX3000, are not kernel threads.” reads the report published by VulnCheck. “They are ordinary userland processes running as root, with real memory footprints, named to disappear into a crowd of legitimate ones. They are an implant, a phone-home trojan horse. Our zero-day research team named this ENDLESSDOORS.”

The implant phones home to a hardcoded server, and once it connects, there’s essentially no security checking who’s on the other end. As Baines put it, “there is no handshake, no key exchange, no negotiation” before the router hands over control.

“When the implant reaches a server, it sends a fixed 39-byte hello: a 33-byte class label padded with nulls, then its LAN MAC address. That’s the whole registration. There is no client or server verification.

After that, anything the server sends is handed to popen() and executed as uid 0. There is no allow-list and no sandbox. One reserved string, rctlbash, tells the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it. That is a live interactive root shell.” continues the report. “The vocabulary of this protocol is two phrases: run this as root, and give me a root shell.”

That last part is the whole vulnerability in one sentence. Once connected, anything the command server sends gets executed as root through a basic system call, no allow-list, no sandbox, nothing filtering what commands are acceptable. One specific string even tells the router to open a second connection and hand back a live interactive root shell, essentially a remote login with no password required.

Because the router dials out instead of listening for connections, none of the usual firewall logic helps. A unit sitting behind three layers of corporate firewall is just as exposed as one sitting on the open internet, as long as it can reach the command server somehow. VulnCheck proved this wasn’t theoretical by writing their own tool that impersonated the command server, catching the router’s outbound connection and getting a root shell back in under two seconds.

The researchers pointed out that twenty different router models carry the same backdoor, all of them starting it automatically at boot through an init script named skworker. VulnCheck found the whole fleet dialing out to just four addresses total, hosted across Alibaba Cloud, Vultr, and a Chinese cloud provider, meaning whoever controls those servers controls every affected router in the world simultaneously.

The affected router dials the same tiny set of endpoints. The researchers noted that across all the impacted models it reduces to four primary and secondary endpoints:

VulnCheck skipped the usual courtesy of privately warning the vendor before going public, and explained exactly why. Coordinated disclosure assumes a vendor didn’t mean to ship the flaw, and that assumption didn’t hold here: this was a vendor-built component, started by the vendor’s own boot script, present across two dozen models and years of firmware releases. Warning the company that built it on purpose, in VulnCheck’s view, would only tip off whoever’s running that infrastructure.

Zbtlink said the backdoor was intended only for after-sales maintenance and not present in production devices. However, the company also removed firmware downloads and acknowledged unspecified firmware security vulnerabilities, raising further questions about its explanation.

“This feature is solely intended for after‑sales maintenance and serves no other purposes,” a company spokesman told The Register. “It is generally retained only on sample units to assist customers with software debugging and will not be included in mass‑production shipments.”

There’s no patch coming for any of this, so the fix isn’t waiting around, it’s treating every affected device as compromised by design. Check your model number against the list of twenty, not the brand printed on the case, since the same hardware gets relabeled under multiple names. If you find the backdoor, block the four known command servers at your firewall, and if the router handles anything that actually matters, replace it rather than trust a company that just got caught lying about what it shipped.

“There is no fixed firmware. Treat this as a device-trust problem, not a patching problem.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Backdoor)

CERT/CC warns an unpatched backdoor in several Tenda routers lets attackers bypass login and gain full admin access with a hidden password.

CERT/CC published an alert documenting an undocumented authentication backdoor in multiple Tenda firmware versions, tracked as CVE-2026-11405. The flaw gives anyone who knows the right password full administrative access to the device’s web management interface, regardless of whatever password the actual owner has set. The vendor hasn’t responded, and the vulnerability remains unpatched.

“Several versions of Tenda firmware contain an undocumented authentication backdoor that grants administrative access to the devices’ web management interfaces.” reads the advisory published by CERT/CC. “An attacker can expoit this vulnerability, tracked as CVE-2026-11405, to bypass the password verification process and obtain full administrative control without valid credentials.”

The affected firmware versions span several product lines: the FH1201, W15E, AC10, AC5, and AC6. Tenda sells home and business networking gear including routers, switches, wireless access points, and video surveillance equipment. All of these products include a web interface protected by username and password authentication. Or so the documentation says.

The authentication logic sits in the login() function inside the web server binary /bin/httpd. When someone tries to log in, the function first runs through the normal process: MD5-based password hashing, comparison, the usual. If that check fails, instead of stopping there, it does something else entirely.

A matching value grants role=2, which is admin-level access, and creates a valid session with full privileges.

The username field doesn’t matter at all.

“However, if authentication fails, the function invokes GetValue("sys.rzadmin.password") to retrieve an alternate password value from the device configuration. It then performs a direct strcmp() comparison in plaintext between the user-supplied password and the configuration-stored value. A successful match grants role=2 admin-level access and creates a valid session.” continues the advisory. “The associated username is not validated, so any provided username will succeed when paired with the backdoor password.”

An attacker can enter any username and the hidden backdoor password to log in as an administrator. The router’s configured username and password are completely bypassed.

Full admin access to a router’s web interface gives attackers full control of the device. An attacker can redirect traffic by changing DNS settings, disable security features, reconfigure the network, or use the device as a stepping stone into whatever’s connected behind it. The CERT/CC advisory describes the potential outcome as a complete device takeover.

“Successful exploitation grants full administrative access to the device’s web interface, regardless of the configured administrator account credentials.” CERT/CC states. “With administrative control, an attacker can reconfigure the device, alter network settings, and disable security features, enabling broader compromise of the local network.”

The backdoor is baked into the firmware binary, not into any configuration file an admin can edit or reset. The hidden password value lives in the device configuration under sys.rzadmin.password, which means it shipped this way from Tenda intentionally, not as something an owner could accidentally trigger. There’s no way to disable it from the management interface because it isn’t visible there at all.

The vulnerability was reported by an anonymous researcher. Tenda hasn’t acknowledged it or provided any timeline for a fix. CERT/CC’s interim recommendations are to disable remote management on the device, which removes exposure to attackers coming in from the internet, and to change the default LAN IP address to reduce how easily automated scanners can find and probe the device.

No owner-side configuration change removes the code path. Until Tenda ships updated firmware that strips this out entirely, the only meaningful mitigation is making sure the device is unreachable from the internet, and reconsidering whether it should stay in production at all.

If you’re running any of the five affected firmware versions, disable remote management immediately and monitor for a firmware update from Tenda. Given the silence so far, it’s unclear when or whether one will arrive.

“Changing the default LAN IP address may reduce opportunistic discovery by automated scanners that target known default IP ranges. Note that this measure does not prevent deliberate or targeted network scanning.”concludes the advisory.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Tenda)

CVE-2023-33538 allows for command injection in TP-Link routers. We discuss exploitation attempts with payloads characteristic of Mirai botnet malware.

The post A Deep Dive Into Attempted Exploitation of CVE-2023-33538 appeared first on Unit 42.

Washington’s push to ban foreign-made Wi-Fi routers may sound tough on cybersecurity, but like earlier bans on foreign drones and telecom gear it risks becoming security theater that ignores the real problem: Millions of unpatched devices already sitting on American networks.

The post Banning Routers Won’t Secure the Internet appeared first on Security Boulevard.