Two Backdoors Baked in at the Factory
Security research firm VulnCheck has disclosed two previously undocumented implants hardwired into firmware for routers manufactured by Shenzhen Zhibotong Electronics, known as ZBT. Named SPEAKINGSTONE and DARKLANTERN by VulnCheck's zero-day research team and tracked as CVE-2026-74232 and CVE-2026-74233, each implant gives an unauthenticated remote attacker the ability to execute commands as root on the affected device. VulnCheck, acting as the CVE Numbering Authority for both identifiers, rated each 9.3 on CVSS 4.0 and 9.8 on CVSS 3.1, with both vectors describing a network attack that requires no privileges and no user interaction whatsoever.
VulnCheck found both implants present on an $88 Deep Orange 3G/4G/LTE router purchased from a US supplier, a device that turned out to be a white-labeled Zbtlink WE826-T2 running firmware built in 2019. That single consumer purchase predates a related implant, ENDLESSDOORS, tracked as CVE-2026-66747, which VulnCheck had already disclosed on August 5 across at least 20 other Zbtlink router models. Taken together, the three implants suggest factory-level backdooring across a much wider swath of ZBT's product line than any single disclosure has captured on its own.
How SPEAKINGSTONE Phones Home
SPEAKINGSTONE runs as a service called yunmgrd and communicates outward over UDP port 10000 to a hardcoded command-and-control server. Because the implant initiates the connection itself rather than waiting for inbound traffic, it functions even behind NAT and typical egress filtering, the kind of network hygiene many organizations assume protects consumer-grade routers deployed at branch offices or remote sites. VulnCheck describes its protocol as supporting message types that can execute arbitrary commands as root, exfiltrate the router's WAN PPPoE username and password, read or write a DNS hijack list, and open a reverse SSH tunnel back to the operator.
VulnCheck's own framing leaves little ambiguity: "This is a surveillance implant with root access to every device it runs on." To measure the implant's real-world reach, VulnCheck registered SPEAKINGSTONE's hardcoded backup command-and-control domain, which it found unregistered, and stood up a server running a reverse-engineered version of the protocol. Beacons began arriving as soon as the server went live. As of August 21, 392 unique devices had checked in, with 390 located in China and 83 percent sitting on China Mobile's network, though VulnCheck is careful to note that figure is a floor drawn from devices that never had a primary server configured, not a count of every affected unit worldwide.
DARKLANTERN's Authentication Barely Exists
The second implant, DARKLANTERN, runs as a service called infosrvd on UDP port 9992, a port the router's stock firewall configuration leaves open to inbound connections from any address on the internet by default. VulnCheck's advisory describes the service's authentication scheme as effectively decorative, resting on a hardcoded salt combined with an all-zero wildcard MAC address value that bypasses the service's own address verification check entirely. In practice, that means any attacker who knows the protocol can authenticate to DARKLANTERN as if they were the router's rightful administrator, regardless of what device they are actually connecting from.
Scanning the internet between August 18 and August 21, VulnCheck identified 203 internet-facing DARKLANTERN instances spread across 22 countries, self-reporting 16 distinct router models. That count reflects hosts that responded to a probe rather than a confirmed tally of every compromised or exposed device, meaning the true population of vulnerable routers sitting on the open internet right now is almost certainly larger than the scan captured. VulnCheck's advisories list specific affected models and firmware builds for each CVE, spanning brand names including Zbtlink, MoreQuick, and a long list of devices marked under an unidentified vendor in the CVE records themselves.
Same Hardware, Different Sticker
One of the more frustrating findings for defenders is that ZBT sells the same underlying hardware and firmware to resellers who slap their own branding on the case, which means a device sitting on a network today may not carry any visible ZBT or Zbtlink marking at all. VulnCheck and The Hacker News confirmed through the IEEE-registered MAC prefix database that the address blocks 78:A3:51 and F8:5E:3C both belong to Shenzhen Zhibotong Electronics, giving network administrators a way to identify the true manufacturer of a device from its MAC address alone, independent of whatever brand name appears on the packaging or the admin login page.
Neither advisory names a fixed firmware release that resolves the vulnerabilities, and the CVE records list specific firmware builds as affected while marking every other version's status as unknown by default. That leaves an owner running a build outside the exact versions named with no published basis for deciding whether their device is exposed or not, an unusual and unhelpful gap in vendor guidance for a flaw this severe. VulnCheck has flagged CVE-2026-74233 in its own Known Exploited Vulnerabilities catalog, while CISA's Vulnrichment enrichment for the same CVE, recorded August 27, rates exploitation only as proof of concept.
What This Means for Enterprise Network Hygiene
White-labeled cellular routers like the one VulnCheck tested are common in branch office failover setups, IoT deployments, point-of-sale connectivity, and remote work kits shipped to employees, precisely the kind of low-visibility infrastructure that rarely shows up on an enterprise asset inventory built around laptops and servers. A factory-installed backdoor on that class of device sidesteps almost every conventional security control an organization has in place, because the implant is present before the device is ever unboxed and configured, not introduced through a later compromise that endpoint detection or network monitoring might catch.
Security teams should inventory cellular and consumer-grade routers deployed anywhere in their environment, check MAC address prefixes against the ranges VulnCheck identified, and treat any device answering on UDP ports 9992 or 10000 as a candidate for immediate isolation pending firmware verification. Given that ZBT's hardware ships under numerous third-party brand names with no consistent labeling, procurement teams buying inexpensive cellular routers for branch or field deployments should ask suppliers directly about the underlying original design manufacturer before installing them anywhere near a corporate network segment.
