Security researchers have raised serious concerns about routers manufactured by Shenzhen Zhibotong Electronics Co. Ltd. (ZBT) after discovering several hidden remote-access mechanisms inside firmware used across multiple devices.
The concern is particularly significant because ZBT is a major white-label router manufacturer. Its hardware is not always sold under the ZBT name. Instead, other companies purchase the devices and sell them under their own brands across markets including the United States, Canada, Australia, India, the Philippines, Germany, Austria, Bulgaria and Russia.
According to public information cited in the research, ZBT produces millions of routers annually and exports products to more than 50 countries and regions.
That makes identifying potentially affected hardware much more difficult because users may own a ZBT-manufactured router without ever seeing the ZBT name on the box.
Researchers Found Root-Level Remote Access
The findings come from Jacob Baines, chief technology officer at security company VulnCheck.
Baines initially discovered a remote-control implant inside a router being used in his own home office.
He called the backdoor EndlessDoors.
According to his analysis, the tool had been disguised to resemble an ordinary Linux kernel thread, making the process look like legitimate system activity.
When an affected router started, EndlessDoors could reportedly initiate an outbound connection to an external command-and-control server.
That detail is particularly important.
Because the connection originates from inside the network, it may pass through firewalls that would normally block unsolicited incoming connections.
Whoever controlled the associated command infrastructure could potentially issue commands to the router with root-level privileges.
That level of control could theoretically allow an attacker to monitor network activity, steal credentials or use the router as an entry point into other devices on the local network.
VulnCheck says EndlessDoors affects dozens of router models.
The Same Manufacturer Appears Behind Multiple Brands
The first affected router investigated by Baines was sold under the Zbtlink brand, which is associated with ZBT.
He then deliberately purchased another router sold under a different name, DeepOrange, to determine whether the issue extended beyond a single product line.
DeepOrange is described in the report as a New York-based company selling hardware manufactured by ZBT under its own branding.
Interestingly, that second router did not contain EndlessDoors.
Instead, researchers found two other remote-access mechanisms, which they named SpeakingStone and DarkLantern.
Further investigation suggested these may represent earlier generations of similar functionality incorporated into ZBT firmware around 2019.
This is what makes the white-label nature of the hardware particularly concerning.
Customers may believe they are purchasing routers from several unrelated companies when the devices underneath originate from the same manufacturer and share portions of the same firmware.
DarkLantern Listens for Incoming Connections
DarkLantern reportedly works differently from EndlessDoors.
Rather than automatically connecting outward to a remote server, DarkLantern operates as a listener.
That means someone able to reach the relevant router can initiate a connection toward the backdoor.
According to the research, affected ZBT devices were configured to permit traffic on the UDP port used by the implant, making remote access possible unless another firewall or security device prevented it.
During three days of internet scanning, VulnCheck reportedly found 203 DarkLantern instances exposed online.
Of those, 103 were located in the United States.
Other identified systems were primarily found in Russia, Taiwan, China, Ukraine and Israel.
The relatively small number probably reflects the age of the firmware associated with DarkLantern rather than the total number of ZBT devices in circulation.
SpeakingStone Can Call Home Automatically
SpeakingStone is potentially more useful to an attacker because, like EndlessDoors, it reportedly initiates its own connection to external infrastructure.
Once active, it can send information about the router and system to its command server.
That information reportedly includes GPS coordinates.
The remote operator can then issue arbitrary system-level commands.
Researchers also identified more specialised capabilities, including support for DNS hijacking.
DNS manipulation can be especially dangerous because it may allow an attacker to redirect users toward fraudulent websites even when they enter legitimate domain names.
For example, someone trying to visit a banking or email website could potentially be sent somewhere else if the network's DNS responses were manipulated.
Interestingly, one of the SpeakingStone command-and-control domains had reportedly never been registered.
Baines was able to register and sinkhole the domain, allowing him to observe connections from affected devices without providing the original remote-control functionality.
He reportedly received 392 SpeakingStone connections, with almost all originating from China.
Current Firmware Is the Bigger Concern
DarkLantern and SpeakingStone appear to be associated mostly with older or end-of-life devices.
EndlessDoors is more concerning because VulnCheck says it appears inside current ZBT firmware images.
Determining exactly how many affected routers exist is extremely difficult.
White-label manufacturing means one piece of ZBT hardware may appear under numerous unrelated product names.
Baines estimates that the number of devices potentially carrying EndlessDoors could reach six figures, although the report makes clear that an exact total is difficult to establish.
That uncertainty itself is a problem.
An organisation cannot easily patch or replace vulnerable hardware when it does not realise who actually manufactured the router installed at a remote site.
Some Firmware Has Been Updated, but Unpatched Devices Remain on Sale
According to Baines, ZBT responded after being contacted by temporarily removing products from Amazon and its own online store while preparing fixes.
The company subsequently released firmware that removed the implant from some products, after which sales resumed.
However, the problem does not appear to have disappeared completely.
Baines later purchased another ZBT-manufactured device sold under the WiFlyer brand.
According to him, the unit arrived with firmware that was still vulnerable and contained the implant.
This means users cannot necessarily assume that purchasing a newly delivered router guarantees that it contains updated firmware.
Devices may have spent months in inventory, distributors may ship older versions, or white-label partners may not have updated products already in the supply chain.
ZBT and DeepOrange reportedly had not responded publicly to requests for comment at the time of the original report.
Why Routers Are Such Valuable Targets
Routers occupy an unusually powerful position inside a network.
Nearly every internet connection passes through them.
If the router itself is compromised, traditional security software installed on laptops and desktops may not provide complete protection.
A malicious router could potentially observe traffic, redirect DNS requests, manipulate connections or provide attackers with a foothold inside the network.
This is why security researchers frequently describe routers, firewalls and VPN appliances as edge devices.
They sit directly between the trusted internal network and the outside world.
Compromising one can effectively allow an attacker to bypass many protections deeper inside the organisation.
The risk becomes even more serious when the implant provides root-level access.
4G and 5G Routers Create an Additional Challenge
ZBT specialises partly in routers containing integrated 4G and 5G connectivity.
Those products are useful because they can provide internet access in locations where conventional broadband is unavailable.
But that also means they may be installed in extremely remote places.
Baines gave the example of an oil pipeline.
A company might install a cellular router at a remote monitoring station so telemetry can be transmitted back to the central control system.
If that router turns out to contain vulnerable or backdoored firmware, replacing it may require physically sending an engineer hundreds of kilometres to the site.
The same situation could apply to agricultural equipment, industrial monitoring stations, construction sites and other distributed infrastructure.
Replacing a router inside an office is relatively easy.
Replacing hundreds scattered across remote facilities can become a major operational project.
The White-Label Problem Makes Identification Difficult
Perhaps the biggest lesson from the ZBT findings is that the logo printed on a router does not necessarily tell you who built it.
White-label manufacturing is extremely common.
A company can buy hardware from another manufacturer, apply its own branding and sell the product without designing the underlying device itself.
For consumers, that can make affordable networking equipment widely available.
For security teams, however, it creates a supply-chain visibility problem.
A vulnerability affecting one manufacturer may actually appear across dozens of brands.
Baines recommends checking hardware MAC addresses because specific address ranges are assigned directly to ZBT.
That could help organisations identify equipment that originated from the manufacturer even when the commercial branding is different.
Replacing the Hardware May Be the Safest Option
For organisations that discover affected devices, Baines' recommendation is straightforward: disconnect and replace them.
That is a much stronger response than simply installing another firmware update.
The reasoning is understandable.
When researchers discover undocumented root-level remote-access mechanisms inside several generations of firmware, confidence in the entire platform becomes difficult to restore.
Even if one known backdoor is removed, security teams must ask whether other undocumented functionality remains.
For business-critical networks, that uncertainty may be unacceptable.
Replacing the device with equipment from a supplier that has a stronger security and update track record can therefore be the safer long-term decision.
Cheap Networking Hardware Can Carry Hidden Costs
The broader issue applies well beyond ZBT.
Inexpensive routers are attractive because they often provide impressive specifications at much lower prices than established enterprise networking brands.
But the purchase price is only one part of the real cost.
Organisations also need to consider:
Saving money on a router makes little sense if an incident later requires a full network investigation or emergency hardware replacement.
The risk is especially important for businesses connecting remote sites or industrial systems where physical access is difficult.
Consumers Should Check Their Routers Too
Home users should not assume this issue applies only to large companies.
White-label routers are widely sold through online marketplaces.
A device purchased because it offered inexpensive 4G or 5G connectivity may use firmware from a manufacturer the buyer has never heard of.
Users should check the exact model, firmware version and manufacturer where possible.
Routers should also receive regular firmware updates, and remote administration should be disabled unless genuinely required.
Changing default passwords remains essential.
Network devices are often forgotten once installed because they quietly work for years.
Unfortunately, that also means security weaknesses can remain unnoticed for equally long periods.
Final Thoughts
VulnCheck's investigation into ZBT-manufactured routers raises serious questions about the security of white-label networking equipment circulating under numerous brands worldwide.
Researchers identified three separate remote-access mechanisms — DarkLantern, SpeakingStone and EndlessDoors — across multiple generations of firmware, with EndlessDoors reportedly present in current firmware images.
The most concerning functionality can establish command-and-control communications and potentially provide root-level access to the router.
Exactly how many devices are affected remains uncertain because ZBT hardware is sold under numerous third-party brands, but estimates suggest the total could reach into the hundreds of thousands.
For organisations, this is another reminder that network security begins with understanding the hardware itself.
A firewall, antivirus package or endpoint security platform can only do so much if the device carrying all your network traffic contains undocumented remote-access functionality.
And when buying inexpensive routers from unfamiliar brands, it may be worth asking one additional question before connecting them to anything important:
Who actually manufactured this device — and how much do you trust the firmware running inside it?
Comments 0