ENDLESSDOORS: Hidden Remote Control Found in Zbtlink Router Firmware
Chinese router manufacturer Zbtlink has become the focus of a significant dispute following the discovery of a concealed remote management mechanism embedded in its proprietary firmware. Researchers at VulnCheck assert that affected devices autonomously establish connections to external servers and permit the remote execution of system-level commands. The company has denied that the component constitutes a backdoor – while simultaneously suspending firmware downloads citing unspecified security vulnerabilities.
Discovery: Persistent Outbound Connections to a Command Server
VulnCheck Chief Technology Officer Jacob Baines conducted a technical examination of a Zbtlink router and observed repeated, unsolicited attempts to contact an external command server over the internet. Baines named the discovered component ENDLESSDOORS, documented in VulnCheck’s full technical analysis, and attributed it to a small utility called rctl – short for Remote Control Linux, whose source code is available on GitHub. The rctl repository was published on January 14, 2015, and has not been updated since its initial release.
How rctl Works
The utility operates as a client-server pair. The server component listens for incoming connections on port 7000 and can subsequently transmit individual shell commands or instruct the client to open a reverse Bash shell back to the operator. When running with root privileges – as it does on affected Zbtlink devices – this architecture grants the remote party comprehensive control over the router’s operating system.
Masquerading as Kernel Threads
Baines discovered that rctl processes were disguised to resemble legitimate Linux kernel threads. In reality, the processes operated entirely in user space with root privileges, but adopted names indistinguishable from ordinary system components at a casual glance. This camouflage was designed to frustrate detection during superficial inspection of the process list.
No Authentication, No Key Exchange
The connection protocol between the router and its command server provides no meaningful authentication. There is no cryptographic handshake, no key exchange, and no mutual verification of identity. When initiating contact, the client transmits a fixed 39-byte message comprising a 33-byte device class identifier and the MAC address of the local network interface.
Any party capable of intercepting this traffic or seizing control of the target server could potentially intercept and manipulate the command channel. One of the domains contacted by the firmware – rbdg4nzqadui.wikaba.com – has no evident affiliation with Zbtlink. VulnCheck assessed that the operator controlling that endpoint could issue commands to any ENDLESSDOORS-equipped device attempting to connect.
Researchers identified four distinct external addresses embedded across the examined firmware images. Only one domain bore a traceable connection to Zbtlink itself.
Scale: More Than 20 Router Models Affected
VulnCheck reports that the suspicious component was present in firmware images for more than 20 router models. Baines further noted that rctl launched automatically at system startup through a standard initialization script and appeared consistently across images released over a span of several years.
Zbtlink’s Response
The manufacturer denied that the component represents malicious intent, characterizing it as a mechanism developed exclusively for post-sale servicing and remote debugging. A Zbtlink representative stated that the function is typically retained only in test units and is not included in production shipments.
However, the company’s public firmware download page subsequently displayed a notice acknowledging security issues. Zbtlink described vulnerabilities in certain software versions, temporarily removed the affected files, and announced that remediation was underway. An archived copy of the same page from July 31 contained no such warning, and the full firmware catalog remained available for download at that time.
OEM Complexity and Brand Uncertainty
Zbtlink specializes in OEM and ODM manufacturing, offering clients the ability to install custom software on its hardware. The company has previously marketed OpenWrt compatibility and provided tooling for rapid generation of bespoke firmware images. This business model complicates any attempt to assess the true scope of the issue, since Zbtlink hardware may circulate under third-party brand names with customer-supplied firmware.
Researchers located devices marketed under the Zbtlink, ZBT, ZBTWiFi, and Wiflyer brands across Amazon, Alibaba, and Shopify. Because custom firmware builds may omit or replace individual components, the presence of ENDLESSDOORS in every device that has shipped cannot be confirmed at this time.
No Coordinated Disclosure
VulnCheck did not notify Zbtlink before publishing its findings. Baines explained the decision by observing that coordinated disclosure is typically applied to inadvertent programming errors – and that the discovered component did not appear to be an error. It exhibited the hallmarks of a deliberately engineered feature, launched through the firmware’s own startup infrastructure.
Detection Rules and Recommended Actions
Researchers have published detection signatures for Suricata, Snort, and YARA to assist in identifying the associated network connections and suspicious process activity.
For owners of potentially affected devices, VulnCheck recommends replacing the router entirely if a verified clean firmware image is not available. At minimum, administrators should restrict outbound traffic from the device, isolate the local network segment it serves, and treat the equipment as untrusted until a patched and independently verified firmware can be confirmed.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
