Skip to content
Fencer Vulns
critical 9.8

CVE-2026-66747 json

ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant

published 2026-08-05 3 mo ago modified 2026-09-09 2 mo ago also EUVD-2026-53301

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits
0
none known

Summary

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
3 mo ago

Exploit prediction

0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • vulncheck.com https://www.vulncheck.com/blog/zbt-endlessdoors referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Zbtlink CPE2801 Firmware
  • Zbtlink WE1026-5G-WD Firmware
  • Zbtlink WE1326 Firmware
  • Zbtlink WE2007 Firmware
  • Zbtlink WE2008-DSIM Firmware
  • Zbtlink WE2416 Firmware
  • Zbtlink WE3326 Firmware
  • Zbtlink WE5927 Firmware
  • Zbtlink WE5931 Firmware
  • Zbtlink WE5931AC Firmware
  • Zbtlink WE826-T3-DSIM Firmware
  • Zbtlink WG108 Firmware
  • Zbtlink WG209 Firmware
  • Zbtlink WG259 Firmware
  • Zbtlink WG1602 Firmware
  • Zbtlink WG1608-DSIM Firmware
  • Zbtlink WG2105 Firmware
  • Zbtlink WG2107 Firmware
  • Zbtlink WG3526 Firmware
  • Zbtlink ZBT-Z8102AX-2SIM Firmware

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.