Security researchers find surveillance implants in Chinese-made routers sold worldwide

Three Distinct Implants Discovered

The core of the issue lies in the discovery of three different types of malicious code embedded directly into the router firmware. The primary implant, dubbed ENDLESSDOORS, functions as a persistent remote-control system. Unlike standard vulnerabilities that require specific exploits to trigger, ENDLESSDOORS is hardcoded into the software stack and activates automatically upon booting the device.

How the Implant Works

The technical mechanism behind ENDLESSDOORS is particularly concerning for network administrators and privacy advocates. The implant disguises itself as a legitimate Linux kernel process named kworker. This camouflage allows it to blend in with standard system operations, making detection difficult without deep forensic analysis.

Once active, the router periodically connects to a hard-coded command-and-control (C2) server. Crucially, this communication lacks meaningful authentication or encryption protocols. The implant receives commands from the server and passes them directly to a shell running with root privileges. This means an attacker who gains access to the C2 server can execute arbitrary commands on the compromised router, effectively taking complete control of the hardware.

VulnCheck demonstrated the severity of this flaw by successfully impersonating the command server. By hijacking the connection, researchers were able to take full control of their own test routers without needing any user credentials or passwords. This proves that the security breach is not theoretical but a functional reality for anyone using these devices.

Scope and Affected Models

The vulnerability is not limited to a single model. Researchers found ENDLESSDOORS embedded in the firmware of 20 different ZBT models. Specific affected units identified include the Z8102AX, WG3526, WE826-T3-DSIM, and several cellular routers. The severity of this flaw is reflected in the assigned CVE identifier: CVE-2026-66747, which carries a high CVSS score of 9.3.

The hardware itself is manufactured by ZBT but is sold worldwide under a bewildering array of brands and OEM labels. This means that consumers may not even realize they are using a device containing this backdoor, as the plastic casing often bears a different brand name than the actual firmware developer.

Implications for Consumers

The presence of these implants highlights a critical issue in the supply chain of networking hardware. When purchasing routers from obscure OEMs or rebranded devices, users must keep in mind that the brand on the plastic casing is often not the company responsible for writing the firmware. The entity developing the software may hold different values regarding user privacy and data freedom than the consumer expects.

While the surveillance capabilities seem primarily aimed at the domestic market of the manufacturer, the security holes created by these implants pose a risk to the global market. Any device relying on this firmware is susceptible to remote takeover if the command server is compromised or if an attacker finds a way to inject commands into the C2 channel.

What Users Should Know

This discovery serves as a stark reminder of the risks associated with networking hardware from manufacturers that do not prioritize transparent security practices. The lack of authentication and encryption in the implant's communication channel makes it an easy target for interception or hijacking. Until these implants are patched or the firmware is updated, users should exercise caution when deploying such devices on networks handling sensitive data.

For now, the focus remains on understanding that the brand name on the router box does not guarantee the security posture of the device's internal software. As VulnCheck continues to investigate, the full extent of these backdoors and potential variants may yet be revealed.