China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access
Summary: VulnCheck disclosed two undocumented factory implants, SPEAKINGSTONE (service yunmgrd, beacons over UDP port 10000 to a hardcoded C2) and DARKLANTERN (service infosrvd on UDP port 9992, which the stock firewall opens to any internet address), in firmware for routers built by Shenzhen Zhibotong Electronics, tracked as CVE-2026-74232 and CVE-2026-74233 and rated 9.3 on CVSS 4.0. Between August 18 and August 21 VulnCheck found 203 internet-facing DARKLANTERN instances across 22 countries, and after registering an unregistered backup C2 domain it saw 392 unique devices report in, 390 of them in China.
Key Takeaway: VulnCheck's own catalog flags CVE-2026-74233 as exploited in the wild while CISA's Vulnrichment rates it proof of concept, and neither advisory names a fixed firmware release, so an owner on an unlisted build has no published basis for deciding whether the flaw applies. The 392 reporting devices are a floor drawn from an unrepresentative subset, and the same hardware and firmware ships under resellers' brand names, so the model number, not the label on the case, is the reliable check.
Read the original at The Hacker News ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2026-66747CVE-2026-74232CVE-2026-74233
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026