A new supply chain security warning has emerged around routers made by Shenzhen Zhibotong Electronics (ZBT), as two previously undisclosed firmware implants grant remote attackers unauthenticated root access. The implants—dubbed SPEAKINGSTONE (CVE-2026-74232) and DARKLANTERN (CVE-2026-74233)—were uncovered by the researchers at VulnCheck. Both have earned near-top severity ratings: 9.3 under CVSS 4.0 and 9.8 under CVSS 3.1. The attacks exploit the devices over the network—no user interaction or credentials required.
How the Implants Work
SPEAKINGSTONE operates via a service called yunmgrd. It periodically sends out beacons over UDP port 10000 to a hardcoded command-and-control (C2) server. Once contacted, it enables several high-risk actions: executing arbitrary root commands; harvesting WAN PPPoE credentials; hijacking DNS by reading or writing malicious entries; and even opening a reverse SSH tunnel. Because the implant initiates the outbound connection, typical network barriers like NAT or egress filtering do not stop it.
DARKLANTERN runs as the service infosrvd on UDP port 9992, exposed to any internet user due to the router’s firewall. Its authentication mechanism is fatally flawed—it relies on a hardcoded salt and a wildcard MAC address (all zeros), which systematically negates any address checks and grants access without legitimate credentials. VulnCheck’s scans identified over 200 routers with DARKLANTERN visible from across the internet, spanning at least 22 countries and 16 different models.
Affected Hardware, Spread & Indicators
The two implants were found preinstalled on a white-labeled model originally built in 2019, specifically a Deep Orange 3G/4G/LTE router marketed under the WE826-T2 name. Additionally, dozens of other ZBT and Zbtlink models across various firmware builds are confirmed to carry one or both implants. Because ZBT hardware is often rebranded, consumers are urged to check the model number and firmware—brand names may disguise identical underlying devices. Identification is also possible via MAC address ranges tied to ZBT.
VulnCheck registered multiple indicators of compromise (IoCs): known domains used by SPEAKINGSTONE (including a hardcoded C2 and a backup domain recently activated), IP addresses, specific services like yunmgrd and infosrvd, certain file paths, and SHA-256 hashes of relevant binaries. Blocking inbound traffic on port 9992 is noted as a stopgap for DARKLANTERN until firmware updates are available.
Responses & Current Status
ZBT’s parent brand Zbtlink previously addressed a separate implant called ENDLESSDOORS, stating that it was only meant for after-sales maintenance and activated only with customer permission. No statement has been made so far about SPEAKINGSTONE or DARKLANTERN. The company continues to host firmware images—including recent builds covering affected models—on its website.
Meanwhile, the U.S. Cybersecurity & Infrastructure Security Agency (CISA) has not yet added these new CVEs to its Known Exploited Vulnerabilities catalog. However, VulnCheck warns that the exposure across countries and number of models is considerable.
Importantly, firmware from an alternative vendor, MOFI Network, built for the same ZBT platform, did *not* show signs of any of the three implants (ENDLESSDOORS included), pointing to variation depending on firmware source.
This discovery highlights growing concerns about factory-installed malware and backdoors in IoT and network infrastructure hardware. SPEAKINGSTONE and DARKLANTERN present a high-level threat: attackers gaining surprise full control over routers used in homes, small businesses, and likely critical infrastructure. Until firmware updates—or confirmed clean builds—are available, users should treat devices with caution around exposure and configuration.
What This Means & What to Watch
The presence of fully-functional implants in firmware from the factory underscores how supply chain security is not just about later patches—it starts at the hardware design and manufacturing level. The trend of hardcoded backdoors threatens user privacy, national security, and trust in networked devices. Going forward, regulators and manufacturers must demand full transparency about firmware, tools for auditing, and assurances that devices, even those rebranded, are built free of unauthorized access. Users should monitor firmware advisories closely, restrict router exposure to the internet, block suspicious ports like UDP 9992, and replace or update devices if evidence of compromise is found.
