# Zbtlink Routers Found with Built-in Backdoor Allowing Unauthorized Access

*Published August 7, 2026*
*Source: [https://thehackernews.com/2026/08/chinese-made-zbtlink-routers-ship-with.html](https://thehackernews.com/2026/08/chinese-made-zbtlink-routers-ship-with.html)*

## Executive Summary

Researchers have discovered a backdoor in Zbtlink routers that allows unauthorized root access, impacting at least 20 models. The backdoor, intended for maintenance, poses a significant security risk and is being addressed by the manufacturer.

## Article

Recent findings from cybersecurity researchers at VulnCheck have uncovered a significant security issue in at least 20 router models produced by the Chinese manufacturer Zbtlink. These routers come with a pre-installed backdoor that facilitates unauthenticated root shell access, posing a serious threat to users. The backdoor, known as ENDLESSDOORS, is embedded in all 21 firmware images currently provided by Zbtlink over the past two years. It disguises itself as a Linux kernel thread but runs as a userland process with root privileges, frequently attempting to connect to command-and-control servers in China.

ENDLESSDOORS is built on an old tool named rctl, which was uploaded to GitHub in 2015 and left untouched since. This tool allows remote control by listening on port 7000 for incoming connections, enabling the execution of shell commands or opening a reverse bash shell. The lack of authentication or negotiation means that once a connection is established, any command from the server is executed by the router.

The vulnerability is exacerbated by the fact that anyone intercepting the client/server communication can hijack the connection. This makes it possible for attackers to gain control over the router without direct internet access. Zbtlink has acknowledged the issue and temporarily removed the affected firmware versions from their download page while working on a secure update.

Zbtlink's spokesperson stated that the backdoor was intended solely for after-sales maintenance and is usually present only on sample units. They emphasize their commitment to customer security and are actively working on a resolution. Until a fix is released, users are advised to monitor their routers for suspicious processes and block known egress points.