CVE-2026-66747

Name of the Vulnerable Software and Affected Versions Zbtlink router firmware (affected versions not specified)

Description Zbtlink router firmware contains an embedded remote-control implant known as ENDLESSDOORS, which is integrated as an OpenWrt package (librctl.so). The implant runs as root under the process name kworker to mimic kernel threads. It establishes an unauthenticated, cleartext TCP connection to a hardcoded command-and-control server using port 7000 for commands and port 7001 for interactive-shell callbacks. The implant uses the popen() function to execute received strings as root (uid=0), and a specific rctlbash command provides an interactive root shell. Due to the lack of authentication and encryption, any entity capable of intercepting the network path or controlling the C2 address can achieve unauthenticated remote code execution as root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.