China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access
VulnCheck discovered two factory implants (SPEAKINGSTONE and DARKLANTERN) in firmware for routers manufactured by Shenzhen Zhibotong Electronics (ZBT), both granting unauthenticated remote attackers root access SPEAKINGSTONE (CVE-2026-74232) operates as the yunmgrd service, beaconing outbound over UDP port 10000 to a hardcoded C2 server, supporting command execution, credential exfiltration, DNS hijacking, and reverse SSH tunnels DARKLANTERN (CVE-2026-74233) runs as infosrvd on UDP port 9992 wit
68
Hot
72
Quality
58
Impact
Analysis
TL;DR
- VulnCheck discovered two factory implants (SPEAKINGSTONE and DARKLANTERN) in firmware for routers manufactured by Shenzhen Zhibotong Electronics (ZBT), both granting unauthenticated remote attackers root access
- SPEAKINGSTONE (CVE-2026-74232) operates as the yunmgrd service, beaconing outbound over UDP port 10000 to a hardcoded C2 server, supporting command execution, credential exfiltration, DNS hijacking, and reverse SSH tunnels
- DARKLANTERN (CVE-2026-74233) runs as infosrvd on UDP port 9992 with ineffective authentication based on a hardcoded salt and wildcard MAC bypass, exposed inbound to the internet by the stock firewall
- Both vulnerabilities scored 9.3 (CVSS 4.0) / 9.8 (CVSS 3.1), affecting at least 16+ Zbtlink models and multiple white-labeled resellers, with firmware builds dating as far back as 2019
- A backup C2 domain for SPEAKINGSTONE was unregistered; after VulnCheck registered it and ran a reverse-engineered server, 392 devices immediately beaconed in, 99% located in China on China Mobile's network
Why It Matters
This is a significant supply chain compromise affecting consumer-grade networking hardware sold under multiple brand names, demonstrating how factory-level implants can persist across white-label product lines and remain undetected for years. For AI and security practitioners, it underscores the critical importance of firmware provenance, hardware supply chain verification, and the need for active network monitoring of IoT/edge devices that may phone home to unknown infrastructure.
Technical Details
- SPEAKINGSTONE (CVE-2026-74232): Runs as the
yunmgrdservice, initiates outbound UDP beacons on port 10000 to a hardcoded C2 server (www.ac-link[.com] resolving to 47.107.224[.]89 on Alibaba Cloud, Shenzhen). The protocol supports arbitrary root command execution, PPPoE credential exfiltration, DNS hijack list read/write, and reverse SSH tunnel establishment. A hardcoded backup C2 domain (www.findmyipaddr[.com]) was unregistered until VulnCheck claimed it, after which 392 devices immediately reported in. - DARKLANTERN (CVE-2026-74233): Operates as
infosrvdon UDP port 9992, exposed inbound by the router's default firewall. Authentication relies on a hardcoded salt and an all-zero wildcard MAC address that bypasses the service's own source address check, rendering it effectively unauthenticated. 203 internet-facing instances were identified across 22 countries and 16 distinct models during probing. - Affected Ecosystem: ZBT sells identical hardware and firmware to resellers who apply their own branding, making model number (not brand) the reliable identifier. Confirmed models include Zbtlink WE1326, WE357, WE5926, WE826-T2, WG108, WG3526, L3_V2_8, ZBT-7628, ZBT-ZBT7621, MoreQuick MQAC/MQAP series, AP522, AP7628, HC5661A, and others across firmware versions from 2019–2020. MAC prefixes 78:A3:51 and F8:5E:3C are IEEE-registered to Shenzhen Zhibotong Electronics.
- No Remediation Published: Neither advisory names a fixed firmware release, and CVE records list exact builds with unknown status for all other versions, leaving owners without a clear patch path.
- IoCs: Domains (www.ac-link[.com], www.findmyipaddr[.com]), IP (47.107.224[.89]), ports (UDP/9992 inbound, UDP/8897 responses, UDP/10000 outbound), services (infosrvd, yunmgrd, inetdetect), paths (/etc/exec/cmd, /tmp/info.txt, /tmp/yunclient.conf), and SHA-256 hashes for yunmgrd, infosrvd, and inetdetect binaries.
Industry Insight
- Supply chain transparency is a security imperative: The white-label nature of ZBT's business means the same compromised firmware appears under dozens of brand names, making vendor accountability nearly impossible for end users. Organizations should mandate firmware provenance verification and prefer vendors with transparent, auditable supply chains.
- Proactive C2 domain monitoring should be standard: The fact that a backup C2 domain went unregistered and only triggered beacons when claimed by researchers suggests many affected devices may still be phoning home to inactive or unmonitored infrastructure. Network defenders should implement DNS sinkholing and egress filtering for known and suspected C2 domains, particularly on UDP ports commonly used for IoT beaconing.
- CVE granularity gaps enable uncertainty: The advisory's use of upper-bound firmware versions with "unknown" status for unlisted builds creates a compliance and risk-assessment gap. Security teams should treat all firmware versions within affected model families as potentially vulnerable until explicitly confirmed otherwise, and advocate for vendors to publish definitive patch guidance.
Disclaimer: The above content is generated by AI and is for reference only.
Security Research
Related Articles
AI benchmarks have a trust problem and Google wants to fix it
Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth
Think You've Eliminated Chinese AI? Check the Model's Lineage, Cisco Says
PaperCut Releases Emergency Patch for Exploited Zero-Day
Authorities arrest 2 alleged members of prolific hacking group TeamPCP