What happened?

Routers Leaving the Factory Ready to Communicate with an External Server and Receive Commands. How Serious Is the Zbtlink Issue?

A 5G router manufactured by the Chinese company Zbtlink, purchased from Alibaba and installed in an isolated network in a laboratory near Philadelphia, repeatedly attempted to contact an external server. Jacob Baines, Chief Technology Officer of the American cybersecurity company VulnCheck, noticed two processes named kworker, a name commonly used by legitimate Linux kernel components. However, the suspicious processes were not operating system components, but separate programs running with administrator privileges.

Firmware analysis showed that the router had not been infected after purchase. Instead, the mechanism had been embedded in the firmware supplied by the manufacturer and automatically started whenever the device was powered on. VulnCheck named the implant ENDLESSDOORS and identified it in 21 official firmware images released for several Zbtlink router models. The oldest verified firmware version in the publicly analyzed set dates back to September 2020, suggesting that the mechanism may have been present in products sold for nearly six years.

Zbtlink is the brand of Shenzhen Zhibotong Electronics, a company that manufactures 4G and 5G routers and markets them both under its own brand and as white-label products for other companies.

In the worst technical scenario, the operator of the command server could obtain an interactive root shell, the highest level of control over the router. This would allow an attacker to modify DNS settings, redirect users to fraudulent websites, intercept or analyze unencrypted traffic, create access paths to computers, surveillance cameras or other smart devices connected to the local network, install additional software, disable security mechanisms or use the internet connection as a launching point for further cyberattacks.

VulnCheck has also published detection rules capable of identifying requests for the rctlbash command, which is used to establish a remote root shell. There is currently no public evidence, however, that this capability has actually been used against users, nor is there any demonstrated attribution linking it to an institution of the Chinese state. What has been demonstrated is the existence of the technical capability itself.

This Is No Longer Just a Programming Error

The discovery comes only about one month after another important case involving routers manufactured by the Chinese company Tenda. Researchers from the CERT Coordination Center at Carnegie Mellon University showed that the firmware of several Tenda router models contained a hidden authentication mechanism. Whenever normal authentication failed, the firmware checked for an alternative password unknown to the user. Entering this password granted full administrative access, even though the mechanism was undocumented and could neither be seen nor disabled through the router's normal management interface.

The difference between an ordinary software vulnerability and these two cases is significant. A software bug may occur accidentally as the result of an incorrect validation check, a memory error or a programming mistake. In both the Tenda and Zbtlink cases, however, researchers identified code intentionally designed to create an alternative control path. In Tenda's case, this consisted of a hidden secondary password. In Zbtlink's case, it was a program that automatically started during boot, disguised itself as a legitimate Linux process and communicated with external infrastructure in order to receive commands.

Researchers can demonstrate that these mechanisms were intentionally built into the firmware. What they cannot determine solely from the code is why they were introduced—whether for technical support, remote fleet management, maintenance, surveillance or some other purpose.

The two companies have responded differently. Tenda acknowledged the existence of the hidden mechanism in the firmware versions identified by CERT/CC and released firmware updates to eliminate the issue. Zbtlink, however, has taken a different approach. As of August 5, 2026, the company had not issued any official statement regarding the ENDLESSDOORS implant, had not explained its purpose, and had not announced the availability of firmware designed to remove it. According to Reuters, company representatives did not respond to requests for comment before the investigation was published. In the absence of an official explanation, the cybersecurity community is left solely with the technical findings presented by VulnCheck.

A Debate Revisited

The VulnCheck discovery may reignite a debate that has shaped the telecommunications industry over the past several years. Beginning in 2018–2019, a number of Western governments expressed concerns that communications equipment manufactured in China—particularly products intended for 5G infrastructure—could pose risks to national security. Those concerns led several countries to restrict or even exclude certain suppliers from critical communications networks. Much of that debate, however, revolved around risk assessments and geopolitical considerations rather than publicly available technical evidence demonstrating the existence of hidden control mechanisms in commercial products.

The Zbtlink case is different. It does not prove that the concerns raised in previous years were justified, nor can it be generalized to the entire Chinese telecommunications industry. What it does provide is a technically documented example of a hidden mechanism identified in a commercially available product, illustrating why firmware security and the integrity of the global technology supply chain remain among the most sensitive issues in cybersecurity.

Why This Matters

The issue extends well beyond Zbtlink users. The most difficult part of the investigation is not counting routers carrying the Zbtlink brand, but identifying products built by the same manufacturer and sold under different names. Zbtlink also operates as an OEM/ODM manufacturer, two business models that are extremely common in the electronics industry.

The Chinese company Shenzhen Zhibotong Electronics does not manufacture products solely under its own brand. It also designs and manufactures networking equipment for third parties.

Under the OEM (Original Equipment Manufacturer) model, an established company—whether American, European or from any other country—designs the product and defines all technical specifications, while the Chinese factory manufactures it. The router is then sold under the customer's own brand.

Under the ODM (Original Design Manufacturer) model, the process is reversed. The Chinese manufacturer designs the entire product—including the hardware, firmware, enclosure and most of its functionality—while a well-known brand purchases the product largely unchanged and sells it under its own logo and packaging. VulnCheck has already observed that the same router model is marketed under both the Zbtlink and Wiflyer brands, while the company itself openly advertises its white-label manufacturing services, allowing products to be sold under different commercial names.

This distinction is critical. If a mechanism such as ENDLESSDOORS is introduced into an ODM-developed product, the same firmware may ultimately appear in routers sold under numerous different brands, making it virtually impossible for end users to identify the actual manufacturer.

Consequently, the real challenge is not identifying routers carrying the Zbtlink brand. Such products are already available on the European market through major online retailers. The real challenge is identifying every product built by the same manufacturer and marketed under different names. Only after identifying the brands, importers, models and related firmware versions will it be possible to estimate the true scale of the issue.

What Comes Next

The investigation is only beginning. To understand the true scale of the issue, researchers will need to answer several key questions:

  • In which countries were the affected routers sold?

  • Under which brand names were they marketed?

  • How many of these devices are still active?

  • Did the command servers actually transmit instructions to the routers?

  • Does the same mechanism exist in firmware developed by other manufacturers?

Much of this work will likely be carried out with the help of artificial intelligence and automated analysis tools. Researchers can download thousands of firmware images, automatically unpack them, and search for code sequences, digital certificates, internet domains, similar functions, and other indicators of compromise. AI models can accelerate the classification of decompiled code and the identification of related variants, while established tools such as YARA, Binwalk, Suricata, and hash analysis provide reproducible technical evidence. VulnCheck has already released YARA rules for identifying the ENDLESSDOORS implant, as well as Suricata and Snort signatures for detecting the network traffic it generates.

For ordinary users, verification is not straightforward. The first step is to identify the exact router model and the installed firmware version, and then compare them with the list of affected models published by VulnCheck. Organizations operating firewalls and network monitoring systems can check whether devices within their networks are communicating with the domains and technical indicators identified by the researchers, including zbtctl.epplink.net, online-string.com, rbdg4nzqadui.wikaba.com, or connections to TCP port 7000.

If a router is confirmed to be affected, the safest course of action is to remove it from service until an independently verified firmware update becomes available. A factory reset does not remove the implant, since it is embedded in the manufacturer's firmware itself. In some cases, installing an official OpenWrt firmware may provide a solution, provided the router model is supported and the installation is carried out correctly.

Could European Authorities Become Involved?

The case also raises important questions for European regulators. Wi-Fi routers are radio equipment and fall under the scope of the European Radio Equipment Directive (RED). European legislation requires internet-connected radio equipment not only to operate safely within communications networks but also to incorporate appropriate safeguards for cybersecurity, personal data protection, and user privacy. The cybersecurity requirements applicable to these products are already in force, with the objective of preventing potentially insecure connected devices from entering the European market.

In Romania, ANCOM, the National Authority for Management and Regulation in Communications, states that it gives priority to actions aimed at ensuring the safety of communications equipment, strengthening the resilience and security of public electronic communications networks, and safeguarding the secure use of radio spectrum through monitoring and enforcement activities. Depending on the nature of the identified risks, other Romanian authorities may also become involved, including the National Authority for Consumer Protection (ANPC) and the National Directorate for Cyber Security (DNSC) if indicators of cybersecurity incidents emerge. At the European level, ENISA coordinates information sharing and cooperation among Member States, while decisions regarding the testing, restriction, or withdrawal of products from the market remain the responsibility of the competent national authorities.

In the coming months, attention is unlikely to remain focused solely on Zbtlink. The more important question is whether ENDLESSDOORS represents an isolated incident or merely the first publicly documented example within a broader category of firmware developed under OEM and ODM manufacturing models. The answer to that question will determine whether this proves to be a single security incident or the beginning of one of the largest investigations into the security of commercial networking equipment in recent years.