Executive Summary
A critical supply chain vulnerability (CVE-2026-66747, CVSS 9.8) has been disclosed affecting the entire Zbtlink router product line. Every published firmware build ships with an embedded remote-control implant called ENDLESSDOORS — built from the open-source ycsunjane/rctl tool packaged as an OpenWrt module (librctl.so). The implant launches automatically at boot, runs as root, and disguises itself under the process name kworker to blend in with legitimate Linux kernel worker threads.
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-66747 |
| CVSS Score | 9.8 (Critical) |
| Implant Name | ENDLESSDOORS |
| Underlying Tool | ycsunjane/rctl (open-source remote control) |
| Package Type | OpenWrt package (librctl.so) |
| Process Disguise | kworker |
| Privileges | root |
| Trigger | Boot (started automatically) |
| Scope | All published Zbtlink firmware builds across product line |
What Is ENDLESSDOORS?
ENDLESSDOORS is a backdoor implant embedded directly in Zbtlink router firmware. It is not a third-party exploit or a vulnerability discovered post-manufacture — it is intentionally shipped in every firmware release across the entire Zbtlink product line.
The implant is based on ycsunjane/rctl, a publicly available remote control tool published on GitHub. Zbtlink compiled it as an OpenWrt package (librctl.so) and bundled it into all firmware images. At boot time the rctl daemon is automatically started by init scripts and runs as root under the disguised process name kworker — the same name used by legitimate Linux kernel worker threads — making it difficult to identify during casual process inspection.
Capabilities
As a full remote control tool, ENDLESSDOORS can provide:
| Capability | Description |
|---|---|
| Remote Shell | Execute arbitrary commands as root |
| File System Access | Read, write, delete any file on the device |
| Network Traffic Interception | Inspect or redirect all traffic through the router |
| Credential Harvesting | Access stored Wi-Fi passwords, VPN credentials |
| Pivoting | Use the router as a launch point for attacks on LAN devices |
| Persistence | Survives reboots; present in all firmware versions |
| Config Manipulation | Modify firewall rules, DNS, routing tables |
Why This Is Classified as a Supply Chain Issue
Unlike a typical vulnerability caused by a coding error, CVE-2026-66747 represents a deliberate supply chain compromise:
- The backdoor is present in all published firmware builds across Zbtlink's product line — there is no unaffected version to update to
- It was packaged as an OpenWrt module (official packaging format), not hidden in an obscure binary blob
- It runs under a process name chosen to evade detection (
kworker) - The underlying tool (
ycsunjane/rctl) provides full remote control, not just a diagnostic interface
This pattern — a legitimate-looking package bundled into embedded firmware to provide persistent remote access — is consistent with either a deliberate vendor backdoor or a deeply embedded supply chain compromise during the firmware build process.
Identifying Exposure
Check for the kworker Implant
If you have a Zbtlink router, check for the presence of the implant:
# SSH into the router (if enabled)
# Check running processes for suspicious kworker
ps aux | grep kworker
# Legitimate kernel kworkers are brackets in process names: [kworker/0:0]
# A plain "kworker" without brackets is suspicious
# Check for librctl.so
ls /lib/librctl.so 2>/dev/null && echo "BACKDOOR PRESENT" || echo "Not found"
# Check init scripts for rctl
grep -r rctl /etc/init.d/ /etc/rc.d/ 2>/dev/null
# Check running ports opened by rctl
netstat -tlnp | grep kworker
ss -tlnp | grep kworkerNetwork Detection
# From a network monitoring system, watch for unexpected outbound connections
# from your router's WAN IP to unfamiliar remote endpoints.
# ENDLESSDOORS may beacon home to a C2 server.
# Check router's established connections (if you have access)
cat /proc/net/tcp6
netstat -an | grep ESTABLISHEDRemediation
There is no patched Zbtlink firmware available for this vulnerability as of the disclosure date — the backdoor is present in all published builds across the entire product line.
Recommended Actions
| Priority | Action |
|---|---|
| Immediate | Isolate the router from sensitive network segments |
| Immediate | Do not expose router admin interface to the internet |
| Short-term | Replace with a router from a vendor with a clean supply chain |
| Short-term | Flash with a trusted third-party firmware if supported (e.g., OpenWrt community builds without this package) |
| Ongoing | Monitor for suspicious outbound connections from the router |
Replacing the Firmware
If your router model is supported by the OpenWrt community project (not Zbtlink's own builds), consider flashing a clean community OpenWrt image:
# Check OpenWrt Table of Hardware for your specific model:
# https://openwrt.org/toh/start
# WARNING: Flashing incorrect firmware can brick your device.
# Verify the exact model and follow OpenWrt installation instructions carefully.Network Isolation
If immediate replacement is not possible:
- Segment your network — place the router on an isolated VLAN or use a different device for critical traffic
- Block outbound connections from the router to unexpected hosts using upstream firewall rules
- Disable remote management and any cloud features that allow Zbtlink to reach the device
- Do not store sensitive credentials (VPN, passwords) in the router's configuration
Detection Indicators
| Indicator | Type |
|---|---|
Process named kworker without brackets ([kworker/n:n] format) | Process anomaly |
/lib/librctl.so present on filesystem | Backdoor file |
rctl entries in /etc/init.d/ or startup scripts | Persistence mechanism |
| Unexpected outbound TCP connections from router | C2 beacon |
| Network traffic to unknown external IPs on unusual ports | Exfiltration/C2 |