Chinese Zbtlink Routers Ship With Factory Backdoors
Some routers do not get hacked. They arrive already open. Security firm VulnCheck has found two more factory backdoors in cheap Wi-Fi routers made by the Chinese vendor Zbtlink, on top of one it disclosed earlier. The worst of them opens an unauthenticated root shell straight to the public internet, and the router's own firewall is configured to let the world in. This is not a bug you patch, it is behaviour that shipped from the factory.
Three implants, one open door
VulnCheck now counts three separate implants in Zbtlink firmware, all baked in before the box ever reached a shelf:
- DARKLANTERN is the dangerous one. It runs as a service called infosrvd, listens on UDP port 9992 on the internet-facing side of the router, and executes commands with no password at all. The stock firewall deliberately allows that port in from anywhere.
- SPEAKINGSTONE and ENDLESSDOORS are phone-home implants: they reach back to Zbtlink's own cloud servers and wait for remote commands.
- The two new ones are written in Nim and talk over UDP, and the "protection" around the open shell is a checksum anyone can forge plus a MAC filter with an intentional bypass.
Between 18 and 21 August, VulnCheck counted 203 of these routers exposed on the public internet across 22 countries, and the responding devices reported 16 different models. This is a firmware-level backdoor shipped across a whole product line, not a single bad unit.
Why a backdoored router beats your VPN
People often assume a VPN makes the router underneath it irrelevant. It does not. The router is the layer beneath everything you do: it can redirect your DNS, block or reroute the connections that are not inside a tunnel, and attack the other devices on your network directly. If the VPN runs on the router itself, it is fully in the attacker's hands. A hijacked router is also how home devices get quietly enlisted as proxies for other people's crime, which we walk through in our guide on how to check whether your router is part of a botnet. When the box that carries your traffic answers to someone else, encryption higher up the stack only does so much.
What to do
- Know what you own. Zbtlink hardware is often sold rebranded or built into other products, so the name on the case may not say Zbtlink. Check the model and, if you can, whether a service is listening on UDP 9992.
- Do not expose the admin side to the internet. Disable remote management and, where you can, put an untrusted router behind another firewall rather than facing the internet directly.
- Prefer vendors that fix things. A backdoor built into firmware is a trust problem, not a settings problem. For a device like this, replacing it is often safer than hoping for a clean update.
- Keep mainstream gear patched too. Router flaws are not only a budget-brand story: even big names shipped serious ones this week, as with the root-level bugs in TP-Link Archer routers.
