The router nobody chose is phoning home
Somewhere in your building there is a box nobody really chose. It arrived with a broadband contract, or a contractor fitted it during an office move, or someone ordered a 4G backup router off Amazon the week the line went down. It has no logo you recognise, or one you have never looked up. It has been quietly passing your traffic ever since.
On 5 August, researchers at VulnCheck published findings on one such family of boxes, and the finding is not that they can be hacked. It is that they were built to take orders from strangers.
What they found
VulnCheck bought a Zbtlink AX3000 cellular router and watched what it did on an isolated network. Every 35 seconds or so, it reached out to servers on the internet and waited to be told what to do.
That behaviour is not the result of a break-in. VulnCheck's Jacob Baines documented an implant, named ENDLESSDOORS, embedded in the firmware and started at boot by the manufacturer's own startup script. It is present in all 21 firmware images the vendor had published on its download page, spanning more than two years of releases, across at least 20 router models. It has been assigned CVE-2026-66747.
The mechanics are about as thin as security gets. When the implant reaches one of its servers it sends a fixed 39-byte greeting containing the router's network address. There is no password, no key exchange, and no check of who is on the other end. After that, anything the server sends back is run on the router as the highest-privilege user. One particular word in the protocol tells the router to open a live interactive shell. As Baines puts it, the vocabulary of the protocol is two phrases: run this as root, and give me a root shell.
That means anyone who can answer the phone owns the router. Not just the manufacturer: anyone who controls one of those domain names, or the network path to them, or the address one resolves to.
Why your firewall does not help
This is the part worth sitting with, because it inverts the mental model most people hold about network security.
The usual assumption is that things behind the firewall are hard to reach. Nobody can get in from the outside, because there is nothing listening and no rule letting them through. That assumption holds for attacks that come inwards.
This one goes outwards. The router opens the connection itself, from inside your network, the same way any computer of yours opens a connection to a website. There is no port to find and no inbound rule to defeat. In VulnCheck's words, a unit sitting behind three layers of firewall in a back office is exactly as reachable as one sitting on a public address, as long as it can get out to the internet.
So the reassuring answer, "it is behind our firewall", is not an answer here.
The bit that makes this hard to check
You cannot resolve this by looking at the badge on the case. Zbtlink openly sells what the trade calls OEM and ODM services, meaning it manufactures hardware and firmware for other companies to put their own branding on. The same device sold under the Zbtlink name also appears under at least one other brand, Wiflyer, and VulnCheck bought its unit through Alibaba. The researchers are blunt about the implication: match on the model number, not the logo on the case. They also say plainly that the true number of affected devices may be larger than the 20 models they examined, and that they have no way to count the rest.
That is the uncomfortable shape of this story. A UK business that has never heard of Zbtlink can still be running one of these, because the box on the wall says something else entirely.
There is also no patched firmware to install. VulnCheck chose not to notify the vendor before publishing, on the reasoning that coordinated disclosure exists to give a vendor time to fix an accident, and this was not an accident: it is a component the vendor shipped, started by the vendor's own script, across years of releases. The manufacturer has since taken the affected firmware off its download page and told The Hacker News that the feature is "solely intended" for after-sales maintenance, that it is "generally retained only on sample units to assist customers with software debugging", and that it is working on fixed firmware. Speaking to The Register, the company denied its products contain backdoors while pausing firmware downloads to fix security issues anyway.
Whether you read that as a remote maintenance feature or as a backdoor barely changes what you should do. An unauthenticated root shell available to anyone who answers the call is the same risk either way.
What to do this week
Find out what your network kit actually is. Not the brand, the model number. Walk the comms cupboard, the back office, the branch sites, and any vehicle or temporary setup with a 4G router in it. Write down make, model, and where it came from. Most businesses have never done this and are surprised by what turns up.
Pay particular attention to cellular and backup routers. These are the ones bought in a hurry, fitted by someone who has since moved on, and never revisited. Look for Zbtlink, ZBT, ZBTWiFi, and Wiflyer branding, and treat any unbranded cellular router of unclear origin as unknown until proven otherwise. The full model list is in VulnCheck's write-up.
Ask your IT provider two questions. First: which of our network devices can reach the internet on their own, and would we see it if one did? Second: do any of our routers phone out to addresses we cannot account for? A provider who cannot answer either question is telling you something useful.
If you find one, replace it rather than patch it. There is no fixed firmware, and disabling the startup script means trusting the rest of an image that shipped this in the first place. For anything carrying real business traffic, replacement is the honest answer. If replacement has to wait, the interim step is strict control over what that device is allowed to reach, and treating the network behind it as untrusted.
Change how you buy this kit next time. Cheap network hardware from an unfamiliar brand carries a cost that does not appear on the invoice. For anything sitting between your business and the internet, buy from a vendor who publishes security advisories and issues firmware updates, and keep a record of what you bought and when.
How Steelwise can help
Working out what is actually plugged into your network, what it talks to, and which pieces of it you would struggle to replace is the kind of review we do. Get in touch.
Further reading
- NCSC: Device Security Guidance covers choosing, configuring, and retiring network devices.
- NCSC: Asset management on knowing what you own, which is the whole battle here.