CVE-2026-66747: Zbtlink Router Firmware RCE Vulnerability

CVE-2026-66747 Overview

CVE-2026-66747 documents an embedded remote-control implant, tracked as ENDLESSDOORS, present in every published Zbtlink router firmware build across the product line. The implant is the open-source ycsunjane/rctl tool compiled into the firmware as an OpenWrt package (librctl.so), started at boot and masquerading as a kernel worker thread under the process name kworker. It phones home over cleartext TCP to a hardcoded command-and-control (C2) server every ~35 seconds, with no authentication and no transport encryption. Any party that answers at the C2 address or hijacks the network path obtains unauthenticated remote code execution as root [CWE-506].

Critical Impact
Unauthenticated remote code execution as uid=0 on every Zbtlink router running affected firmware, exploitable by anyone who can intercept or impersonate the hardcoded C2 endpoint.

Affected Products

Zbtlink router firmware — all published builds across the product line
OpenWrt-based images shipping the librctl.so package
Devices reachable from any network path to the hardcoded C2 fallback domain

Discovery Timeline

2026-08-05 - CVE-2026-66747 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-66747

Vulnerability Analysis

ENDLESSDOORS is not a memory-corruption bug but an intentional backdoor component built into shipped firmware. The librctl.so binary is derived from the public ycsunjane/rctl project and is launched at boot as root. The process renames itself to kworker to blend with the legitimate kernel [kworker/*] thread pool, complicating triage on live devices.

The implant opens no listening socket. Instead it initiates outbound TCP connections to a hardcoded C2 host: a command channel on port 7000 and an interactive-shell callback on port 7001. Retries occur approximately every 35 seconds until a peer answers. Once connected, the command handler accepts arbitrary strings and passes them directly to popen() running as uid=0. A reserved keyword, rctlbash, triggers the interactive root shell callback on port 7001.

Root Cause

The firmware ships a hardcoded, unauthenticated, cleartext client-side backdoor. There is no shared secret, no TLS, no certificate pinning, and no origin validation on the C2 endpoint. Trust is bound solely to the ability to answer at the hardcoded address, meaning control is not restricted to whoever originally planted the implant [CWE-506].

Attack Vector

Exploitation does not require exposure of the router's WAN or LAN services. An attacker who controls the C2 IP address, occupies any point on the network path (DNS resolver, upstream ISP router, BGP peer), or registers the hardcoded fallback domain if it lapses, receives the periodic beacon and can issue arbitrary shell commands. On-path DNS or route hijacking, expired-domain acquisition, and C2 impersonation are all viable. Successful takeover yields persistent root on the router, positioning the attacker for traffic interception, lateral movement, and downstream device compromise.

Detection Methods for CVE-2026-66747

Indicators of Compromise

Presence of the file librctl.so in the OpenWrt package set on a Zbtlink device.
A process advertising itself as kworker that is not a kernel thread (has a mapped userspace binary and open network sockets).
Outbound TCP connections to the hardcoded C2 host on ports 7000 and 7001, recurring roughly every 35 seconds.
DNS queries from router management IPs resolving the hardcoded fallback domain referenced in the VulnCheck advisory.

Detection Strategies

Inspect north-south traffic from router management interfaces for periodic ~35-second cleartext TCP beacons to fixed external endpoints.
Compare live process listings to expected kernel thread inventories; genuine [kworker/*] threads have no executable path and no network sockets.
Extract firmware images and hunt for the librctl.so artifact and strings tied to the rctl project or the rctlbash command keyword.

Monitoring Recommendations

Forward router NetFlow, DNS, and syslog into a centralized analytics tier and alert on repeated fixed-interval outbound sessions from infrastructure devices. Singularity Data Lake can ingest these feeds via OCSF normalization for cross-source correlation.
Add threat intelligence watchlists for the C2 domain and IP indicators published in the VulnCheck advisory.
Track first-seen destinations from network gear; new external ports 7000/7001 sessions warrant immediate investigation.

How to Mitigate CVE-2026-66747

Immediate Actions Required

Assume every Zbtlink device on the network is compromised until proven otherwise and isolate management interfaces from untrusted segments.
Block outbound TCP to the hardcoded C2 host and to ports 7000 and 7001 at the perimeter and at every upstream hop under your control.
Sinkhole or block DNS resolution of the hardcoded fallback domain identified in the VulnCheck blog post.
Rotate any credentials, keys, or secrets that traversed affected routers.

Patch Information

No vendor-published patch is referenced in the NVD record at the time of writing. Consult the ZBT router firmware download page for vendor releases and confirm that any candidate build does not still contain the librctl.so package before deployment. Until a clean firmware is verified, replacement with non-affected hardware or reflashing with a trusted OpenWrt build is the reliable remediation.

Workarounds

Reflash affected devices with a trusted OpenWrt image that omits the rctl package, verifying librctl.so is absent and no process is renamed to kworker from userspace.
Enforce strict egress filtering on router management VLANs: default-deny outbound, allow only vetted update and NTP endpoints.
Deploy DNS response policy zones (RPZ) to block resolution of the hardcoded fallback domain and log any query attempts as high-severity events.

bash

# Egress block example (Linux upstream gateway) — drop ENDLESSDOORS beacons
iptables -I FORWARD -p tcp -m multiport --dports 7000,7001 -j DROP

# Detect a 'kworker' process that is actually a userspace binary
for pid in $(pgrep -x kworker); do
  exe=$(readlink /proc/$pid/exe 2>/dev/null)
  [ -n "$exe" ] && echo "SUSPECT pid=$pid exe=$exe"
done