China-Made ZBT Routers Shipped With Pre-Installed Backdoors Granting Root Access
Two undocumented factory implants, SPEAKINGSTONE and DARKLANTERN, discovered in ZBT router firmware allow unauthenticated attackers to gain root access and execute commands.
Shenzhen Zhibotong Electronics (ZBT) routers have been found to contain two pre-installed, undocumented factory implants that grant unauthenticated remote attackers root-level access and the ability to execute arbitrary commands. These vulnerabilities, identified by VulnCheck's zero-day research team and tracked as CVE-2026-74232 (SPEAKINGSTONE) and CVE-2026-74233 (DARKLANTERN), pose a significant supply chain risk.
Both implants have been assigned high CVSS scores, with VulnCheck rating them 9.3 for CVSS 4.0 and 9.8 for CVSS 3.1, indicating critical severity. The exploits require no privileges and no user interaction, making them easily weaponizable by attackers.
The SPEAKINGSTONE implant operates as the 'yunmgrd' service and communicates via UDP port 10000 to a hardcoded command-and-control (C2) server. Its outbound nature allows it to bypass Network Address Translation (NAT) and standard egress filtering. The implant's protocol supports commands for executing arbitrary code as root, exfiltrating sensitive network credentials like PPPoE usernames and passwords, manipulating DNS settings, and establishing reverse SSH tunnels, effectively turning the router into a surveillance device.
DARKLANTERN, running as the 'infosrvd' service on UDP port 9992, is even more accessible as its stock firewall allows inbound connections from any internet address. VulnCheck noted that its authentication mechanism is weak, relying on a hardcoded salt and a wildcard MAC address that bypasses its own security checks. This makes it trivial for attackers to gain control.
VulnCheck's research identified 203 internet-facing DARKLANTERN instances across 22 countries between August 18 and August 21, 2026, affecting at least 16 distinct ZBT router models. The implants were discovered on a ZBT-WE826-T2 router, manufactured in 2019, which was purchased from a U.S. supplier. This discovery follows VulnCheck's earlier disclosure of the ENDLESSDOORS implant (CVE-2026-66747) in at least 20 ZBTlink router models.
The specific affected models and firmware versions for DARKLANTERN include Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, WG3526 (firmware 19.1101), WE2426-C (19.1112), WE5926-EC_QP (20.0516), WF3526-P (19.051), CTN720-W1, LF-1541, MT7620N (19.1101), and WRC1 (20.0622). For SPEAKINGSTONE, affected models and firmware include Zbtlink L3_V2_8 (3.0.0.4.528), WE826-T2 (19.1101), ZBT-7628 (1.0.0.2.007), ZBT-ZBT7621 (1.0.0.3.001), MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, MQAP-7628 (1.0.0.2.000), AP522 (1.0.0.2.014), AP7628, HC5661A (3.0.0.4.380), APG721B (19.0809), HK300 (1.0.0.2.032), and MAP-N10 (1.0.0.2.044).
Since no fixed firmware releases have been announced, users are advised to identify affected devices by their MAC address prefixes (78:A3:51 and F8:5E:3C, both assigned to Shenzhen Zhibotong Electronics) rather than just model numbers, as ZBT white-labels its hardware. VulnCheck has flagged CVE-2026-74233 in its own Known Exploited Vulnerabilities catalog, indicating public reports of exploitation in the wild, though it has not yet appeared on CISA's KEV list.
VulnCheck's research also revealed that the SPEAKINGSTONE implant uses a hardcoded backup C2 domain which, when found unregistered, was registered by VulnCheck to monitor incoming traffic. This monitoring revealed 392 unique devices reporting in, predominantly from China, suggesting a widespread potential for compromise. Indicators of compromise, including domains, IP addresses, ports, services, and file hashes, have been published by VulnCheck to aid in detection and mitigation efforts.