Chinese Router Maker Says Its Firmware Backdoor Is Fine, Actually, Then Quietly Pulls Firmware

Chinese Wi-Fi router manufacturer Zbtlink is having a rough week. Security researchers say its devices ship with built-in backdoors. The company says that's a mischaracterisation. It has also, quietly, taken all its firmware downloads offline while it patches unspecified security vulnerabilities. Make of that what you will.

The accusation came from Jacob Baines, CTO of threat intelligence firm VulnCheck, who published his findings this week after noticing that a Zbtlink router sitting on his desk was persistently trying to phone home to a remote server. Not because it had been compromised post-sale. Because it left the factory that way.

Baines dubbed the implant ENDLESSDOORS. At its core, it's a small piece of software called rctl, or remote control linux, which was uploaded to GitHub back in January 2015 and apparently never touched again. It implements a basic command-and-control client and server. The server listens on port 7000, can push individual shell commands to clients, or instruct them to open a reverse bash shell. The kind of thing that, if a third-party had installed it, would be unambiguously described as malware.

The code runs as root in what look like ordinary Linux userland processes, named to blend in with legitimate system processes. Baines was not subtle about his interpretation: he called it a phone-home trojan horse.

The protocol is remarkably bare. When the implant connects to its server, it sends a 39-byte greeting: a class label padded with nulls, then the device's MAC address. That's it. No handshake, no encryption, no authentication. Which means anyone sitting on the network path between a device and its control server can intercept or hijack the connection. And since one of the four endpoints the implant contacts uses a domain not obviously tied to Zbtlink, the situation is, in Baines' word, damning.

Zbtlink's response to The Register was that VulnCheck had got it wrong. The feature, a spokesperson said, is purely for after-sales maintenance, only kept on sample units to help customers debug software, and wouldn't appear in devices sold at scale. A reasonable defence, if true.

Except Zbtlink's own download page now carries a notice stating that firmware security vulnerabilities have been detected across selected releases, that affected versions have been temporarily pulled, and that engineers are working on patches. The Wayback Machine confirms the page looked entirely normal as recently as July 31, with a full list of firmware downloads and no such admission.

So the company simultaneously told a journalist there's no problem and posted a public notice acknowledging there is one. That's a bold communications strategy.

The spokesperson also pointed out that Zbtlink primarily operates as an OEM and ODM supplier, meaning its customers often run their own firmware rather than Zbtlink's defaults. That's accurate, the company has previously promoted its support for OpenWrt and fast-track custom firmware options. But it does rather expand the potential blast radius. If the base hardware is compromised before customisation happens, downstream products from other brands could be affected too.

Baines decided standard responsible disclosure didn't apply here. The logic being that coordinated disclosure assumes a vendor accidentally introduced a bug and needs time to fix it. If the vendor intentionally shipped the behaviour, notifying them privately just gives whoever operates the command-and-control infrastructure a heads-up.

Zbtlink products are sold under the Zbtlink, ZBT, ZBTWiFi and Wiflyer brands and are available through Amazon, Alibaba and Shopify. Baines says firmware across more than 20 router models contains ENDLESSDOORS.

For anyone stuck with one of these devices, Baines has published detection rules for Suricata, Snort and YARA, along with guidance on identifying affected machines. His actual recommendation is blunter: replace the device. Failing that, put it behind tight egress filtering and treat everything on its local network as hostile.