VulnCheck disclosed a factory-shipped backdoor, codenamed ENDLESSDOORS, in firmware for Chinese-built Zbtlink routers that lets anyone who can reach or hijack the device’s outbound beacon open an unauthenticated root shell. The finding applies to all 21 firmware images currently listed on the vendor’s download site and to at least 20 router models sold under the Zbtlink, ZBT, ZBTWiFi, and Wiflyer brands on Amazon, Alibaba, and Shopify.
The ENDLESSDOORS Implant and the rctl Remote Control Client
The implant uses “rctl” (remote control linux), a small command-and-control client and server uploaded to GitHub in 2015 and never modified since. On the device, the code masquerades as a Linux kworker kernel thread but is actually a userland process running as root, started at boot by an init.d script named “skworker”. Devices beacon to Chinese infrastructure as often as every 35 seconds across four primary and secondary endpoints.
No Authentication on the Path to an Interactive Root Shell
There is no handshake, negotiation, or authentication with the controller. A fixed 33-byte registration label padded with nulls plus the device’s LAN MAC address is sent, and the implant runs whatever the server replies. One reserved string, “rctlbash,” opens a second connection on a separate port, allocates a pseudo-terminal, spawns /bin/sh, and bridges it to the remote side — yielding a live interactive root shell without the router being reachable from the internet.
The Targeted Device Families and the Four Control Endpoints
The affected hardware spans the WE and WG families and includes devices such as the CPE2801 and Z8102AX-2DSIM, sold to home and small-business users. The command-and-control endpoints are zbtctl.epplink[.]net, a Chinese IP, online-string[.]com, and rbdg4nzqadui[.]wikaba[.]com. Because the device never verifies the server’s identity, anyone who controls the network path or the DNS resolution for the domain can hijack outbound rctl communications and obtain a root shell.
Zbtlink Denies the Backdoor While Pausing Firmware Downloads
Zbtlink disputed the finding, describing the component as an “after-sales maintenance” feature retained on sample units. VulnCheck CTO Jacob Baines said coordinated and responsible disclosure did not apply because “this isn’t a memory corruption bug” but a component within the vendor’s product, started at boot by the vendor’s own init script — so there is no independent researcher to coordinate with. The vendor’s download page now carries an acknowledgment of firmware security vulnerabilities with downloads temporarily pulled, a notice that an earlier snapshot of the same page did not contain.
Defensive Checks for the skworker Implant
VulnCheck published Suricata, Snort, and YARA detection rules, and the recommended checks center on files that should not be present on a stock device: /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and /etc/init.d/skworker. Owners are also advised to block egress to the four command-and-control endpoints and, because the LAN could be compromised, to treat the local network as untrusted or replace the unit.
What the ENDLESSDOORS Finding Says About the IoT Supply Chain
The disclosure shows how a supply-chain backdoor can work on a device that never faces the internet directly. Because the router beacons to its control channel without authentication, the trust boundary collapses to whatever the vendor shipped. The finding also reflects the realities of a OEM/ODM market: Zbtlink says it focuses on original design manufacturing and that customers often load their own software, which means the same hardware travels under many names and the population of affected devices is hard to bound.
The practical consequence for the industry is that the firmware image is the effective security boundary for embedded hardware, and buyers who treat a vendor’s stock build as trustworthy have little to fall back on once that assumption fails. For a device sitting inside a home or small-business network, the cost of a compromised root shell is not just the router but everything connected behind it.
