{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-66747", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-66747", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-08-05T10:50:45.576Z", "updatedAt": "2026-08-05T14:20:12.478Z", "importedAt": "2026-10-24T01:58:25.636Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant", "summary": "Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.", "affected": [ { "vendor": "Zbtlink", "product": "CPE2801 Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "22.10.09", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WE1026-5G-WD Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "21.04.07", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WE1326 Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "22.02.18_1", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WE2007 Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "23.08.12", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WE2008-DSIM Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "23.08.11", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WE2416 Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "21.03.22_1", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WE3326 Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "20.09.30", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WE5927 Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "22.08.10", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WE5931 Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "22.05.31", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WE5931AC Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "22.05.31", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WE826-T3-DSIM Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "21.12.21", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WG108 Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "21.08.06_1", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WG209 Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "21.07.28", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WG259 Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "21.03.23", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WG1602 Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "23.10.11", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WG1608-DSIM Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "23.03.16", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WG2105 Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "22.05.30", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WG2107 Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "22.09.08", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "WG3526 Firmware", "platforms": [ "MIPS", "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "22.11.01", "status": "affected", "versionType": "custom" } ] }, { "vendor": "Zbtlink", "product": "ZBT-Z8102AX-2SIM Firmware", "platforms": [ "ARM" ], "defaultStatus": "unaffected", "versions": [ { "version": "7.6.7.2-25.0814_114432", "status": "affected", "versionType": "custom" } ] } ] } } }