Affected: Zbtlink CPE2801 Firmware, Zbtlink WE1026-5G-WD Firmware, Zbtlink WE1326 Firmware, Zbtlink WE2007 Firmware, Zbtlink WE2008-DSIM Firmware, Zbtlink WE2416 Firmware, Zbtlink WE3326 Firmware, Zbtlink WE5927 Firmware, Zbtlink WE5931 Firmware, Zbtlink WE5931AC Firmware and 10 more

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.