Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells

Summary: VulnCheck found a factory-shipped backdoor, codenamed ENDLESSDOORS, in all 21 Zbtlink firmware images available across more than two years and at least 20 router models, starting automatically at boot and beaconing to Chinese command-and-control infrastructure as often as every 35 seconds. The implant masquerades as a Linux kernel kworker thread but runs as a root userland process built on rctl, an obscure GitHub tool from January 2015, and accepts commands with no handshake or authentication, including a reserved string that opens a live interactive root shell on port 7001.
What you should know: Anyone who controls resolution of the implant's phone-home domain, or sits anywhere along the network path, can take a root shell on any affected router without being reachable from the internet - and Zbtlink says the component was meant only for after-sales maintenance.

Read the original at The Hacker News ↗