CVE-2026-66747 Zbtlink CVE debrief

Who should care

Organizations using Zbtlink routers, cybersecurity teams, and network administrators should be aware of this critical vulnerability and take immediate action to inventory, isolate, and patch affected devices.

Technical summary

The Zbtlink router firmware contains an embedded remote-control implant called ENDLESSDOORS, which is based on the open-source ycsunjane/rctl tool. This implant runs as root and communicates with a hardcoded command-and-control server over cleartext TCP without authentication or encryption. The implant can execute arbitrary commands as root, and a specific command provides an interactive root shell. This vulnerability has a CVSS score of 9.3 and is considered critical.

Defensive priority

Critical vulnerability in Zbtlink router firmware with a CVSS score of 9.3, requiring immediate attention.

Recommended defensive actions

• Immediately inventory and identify all Zbtlink routers within your organization.
• Isolate affected devices from the network to prevent potential exploitation.
• Monitor for any suspicious network activity indicative of command-and-control communications.
• Apply firmware updates or patches provided by the vendor, if available.
• Implement compensating controls, such as network segmentation and intrusion detection systems.

Evidence notes

The CVE description reveals that Zbtlink router firmware contains an embedded remote-control implant called ENDLESSDOORS, which is an open-source ycsunjane/rctl tool built as an OpenWrt package. This implant starts at boot, runs as root, and communicates with a hardcoded command-and-control server over cleartext TCP without authentication or transport encryption. The command handler executes received strings as root using popen(), and a specific command provides an interactive root shell. Evidence is based on official CVE and NVD records, as well as references from Vulncheck.

Official resources