CVE-2026-66747 Details

A remote code execution vulnerability has been identified in Zbtlink router firmware, where an embedded implant named ENDLESSDOORS is present in all published builds across the product line. This implant is a modified version of the open-source tool 'rctl', which is integrated as an OpenWrt package. It operates as a root process disguised within the kernel's kworker threads, without opening any listening ports. Instead, it communicates over unencrypted TCP to a hardcoded command-and-control server, attempting to make contact every 35 seconds. The implant's command handler executes received strings as root, and a specific command can be used to establish an interactive root shell. The lack of authentication and encryption in the communication allows for unauthorized remote code execution by anyone who can intercept the traffic or hijack the domain resolution.

There is no official patch available for this vulnerability. Users are advised to replace the affected devices or, at a minimum, move them behind strict egress controls and treat their local area network as untrusted.