That device in your home office, RV, or small business may have been phoning home to a Chinese server every 35 seconds before you ever changed the default password. Not because of a coding mistake. Because someone built it that way. If covert surveillance app behavior in consumer hardware alarms you, what researchers found inside these routers goes further still.
VulnCheck’s researchers discovered three purpose-built remote-access implants — ENDLESSDOORS, DARKLANTERN, and SPEAKINGSTONE — embedded directly in firmware from Shenzhen Zhibotong Electronics (ZBT). The hardware ships globally under rebranded names:
- Deep Orange
- KuWFi
- Wave WiFi
- MoFI Network
- Lippert Components
- Digineo
Think of it like a private-label grocery product — the store brand packaging looks familiar, but the factory floor is somewhere else entirely, making decisions you never agreed to.
ENDLESSDOORS (CVE-2026-66747, CVSS 9.3 Critical — meaning nearly worst possible severity) boots automatically, disguises itself as a Linux process called “kworker,” and contacts a hard-coded command server every 35 seconds over unencrypted TCP. Every command it receives runs with full root privileges — the equivalent of handing over your house keys along with the deed. VulnCheck proved the point by impersonating the command server and taking over their own test router completely. More than 100,000 devices across 20 confirmed models are estimated affected, according to VulnCheck.
Three Implants. One Supply Chain. No Authentication.
Each implant operates independently, meaning a router free of one may still carry the others.
VulnCheck purchased a “Deep Orange” 4G router from a US Amazon listing. It was a rebranded ZBT. It contained two more implants — a finding that echoes broader concerns about surveillance implants engineered at the supply-chain level.
DARKLANTERN (CVE-2026-74233) opens a WAN-facing UDP listener on port 9992 with zero authentication. A fixed 19-byte packet forces the router to surrender its MAC address, firmware version, and model number. Both protections collapse instantly: the salt is static, and the MAC filter accepts all-zero inputs. VulnCheck’s internet scan found 203 exposed instances across 22 countries.
“Domestic Chinese surveillance technology.” — VulnCheck’s characterization of SPEAKINGSTONE’s deployment footprint
SPEAKINGSTONE (CVE-2026-74232) runs as yunmgrd, beaconing outbound over UDP even behind NAT or a firewall. It can:
- steal PPPoE credentials
- rewrite DNS
- execute root commands
- open a reverse SSH tunnel
When VulnCheck registered an unreclaimed backup C2 domain and sinkholed traffic, 392 devices connected. 390 were located in China, predominantly on China Mobile — suggesting carrier-scale deployment, not random consumer installs.
ZBT describes ENDLESSDOORS as an “after-sales technical support mechanism.” VulnCheck’s counter is direct: intent is irrelevant when the channels are unencrypted and unauthenticated. Any attacker who hijacks the C2 domain gets identical root access to whatever ZBT’s own operators hold. Reuters, Tom’s Hardware, and PCMag independently corroborate VulnCheck’s backdoor characterization.
It bears repeating: these are not accidental vulnerabilities. They are deliberately engineered remote-access mechanisms with no meaningful authentication or encryption protecting them.
Security researchers recommend physical hardware replacement rather than relying on firmware updates — because the implants are factory-installed and the supply chain that produced them remains opaque. Knowing how to stay safe from compromised hardware is a practical first step. Not every ZBT-based router contains these implants, but the brand printed on the casing won’t tell you either way. Check VulnCheck’s published model lists and firmware versions at vulncheck.com before assuming your router is clean, and consider auditing your broader home security posture while you’re at it.
