https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 22:56:49 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66747 <p><strong>Affected:</strong> Zbtlink CPE2801 Firmware, Zbtlink WE1026-5G-WD Firmware, Zbtlink WE1326 Firmware, Zbtlink WE2007 Firmware, Zbtlink WE2008-DSIM Firmware, Zbtlink WE2416 Firmware, Zbtlink WE3326 Firmware, Zbtlink WE5927 Firmware, Zbtlink WE5931 Firmware, Zbtlink WE5931AC Firmware and 10 more</p> <p>Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel&#39;s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.</p> <p><strong>Affected:</strong> Zbtlink CPE2801 Firmware, Zbtlink WE1026-5G-WD Firmware, Zbtlink WE1326 Firmware, Zbtlink WE2007 Firmware, Zbtlink WE2008-DSIM Firmware, Zbtlink WE2416 Firmware, Zbtlink WE3326 Firmware, Zbtlink WE5927 Firmware, Zbtlink WE5931 Firmware, Zbtlink WE5931AC Firmware and 10 more</p> <p>Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel&#39;s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.</p> https://vulnerability.circl.lu/vuln/cve-2026-66747