CVE-2026-66747 Zbtlink CVE debrief

Who should care

Defenders responsible for Zbtlink CPE2801 Firmware deployments should assess exposure and prioritize mitigation, as this vulnerability allows for unauthenticated remote code execution as root.

Why it matters

CVE-2026-66747 allows for unauthenticated remote code execution as root in Zbtlink CPE2801 Firmware deployments due to the embedded ENDLESSDOORS implant, requiring immediate verification and mitigation.

• Unauthenticated remote code execution as root
• Potential for DNS or route hijack
• Cleartext communication with command-and-control server
• Lack of authentication and transport encryption

Technical summary

The Zbtlink router firmware contains an embedded remote-control implant called ENDLESSDOORS, which is based on the open-source ycsunjane/rctl tool. This implant allows for unauthenticated remote code execution as root, as it communicates with a hardcoded command-and-control server over cleartext TCP without authentication or transport encryption. The implant opens no listening port and phones home over cleartext TCP to a hardcoded command-and-control server with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds.

Defensive priority

Defenders should prioritize verifying and mitigating exposure to this vulnerability, especially for Zbtlink CPE2801 Firmware deployments.

Recommended defensive actions

• Verify Zbtlink CPE2801 Firmware deployments for exposure
• Implement compensating controls to prevent exploitation
• Monitor for suspicious activity
• Apply vendor remediation when available
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the ENDLESSDOORS implant in Zbtlink router firmware, which allows for unauthenticated remote code execution as root. The implant is based on the open-source ycsunjane/rctl tool and communicates with a hardcoded command-and-control server over cleartext TCP without authentication or transport encryption. The lack of authentication and transport encryption makes it possible for any party to obtain unauthenticated remote code execution as root.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.