Zbtlink halts sales after backdoor found in 20 routers

A cybersecurity firm has disclosed a significant security vulnerability, described as a deliberate backdoor, in at least 20 router models manufactured by the Chinese company Zbtlink. The flaw, which researchers say allows for complete remote takeover of the devices, has prompted the manufacturer to suspend sales and remove affected firmware from its website.

The vulnerability, dubbed "ENDLESSDOORS" by researchers at VulnCheck, is an implant found in the firmware of Zbtlink routers. According to the firm's chief technology officer, Jacob Baines, the implant is a customized version of a remote control tool called "rctl" that was originally uploaded to a public code repository in 2015. Once a router boots, the implant automatically attempts to contact a command-and-control server, potentially as often as every 35 seconds. After sending a simple "hello" message, the device is engineered to execute any command sent back by the server, including instructions to spawn a live, interactive root shell. This grants an attacker full administrative control over the router.

Crucially, because the router initiates the outbound connection, the backdoor does not require the device to be directly...