Recent investigations have uncovered a significant security vulnerability in at least 20 router models produced by the Chinese manufacturer Zbtlink. These devices come pre-installed with a backdoor that grants unauthenticated root access, posing a severe risk to users.
Security firm VulnCheck analyzed 21 firmware images from Zbtlink, spanning over two years, and found that all contained this backdoor. The backdoor operates by initiating connections to command-and-control (C2) servers located in China as frequently as every 35 seconds. Disguised as a Linux kernel thread, the backdoor is actually a userland process running with root privileges, blending in with legitimate system processes.
Dubbed ‘ENDLESSDOORS,’ the backdoor is based on a tool called ‘rctl’ (remote control linux), which was uploaded to GitHub in January 2015 and has remained unchanged since. The ‘rctl’ server listens on port 7000 for client connections, allowing it to send individual shell commands or spawn a reverse bash shell.
In the case of the Zbtlink AX3000 router analyzed by VulnCheck, the ‘kworker’ process is a customized version of ‘rctl’ configured to contact specific endpoints, including IP addresses and domains such as 47.107.224[.]89 and rbdg4nzqadui[.]wikaba[.]com. Notably, the communication lacks any handshake, negotiation, or authentication. Once the implant sends a ‘hello’ message along with the LAN MAC address, it executes any command received in response.
One particular command, ‘rctlbash,’ instructs the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn ‘/bin/sh,’ and bridge it, effectively providing a live interactive root shell. This minimal protocol allows an attacker to run commands as root or obtain a root shell. Anyone along the network path can hijack the client/server communication, and control over the specified domains or their resolved addresses enables control over any ‘ENDLESSDOORS’ implant attempting to connect.
Attackers can exploit this vulnerability to hijack outbound ‘rctl’ communications, gaining live root shell access and taking control of the router without the need for internet reachability.
VulnCheck identified that every firmware listed on Zbtlink’s download page embeds the ‘rctl’ implant, which starts at boot via an init.d script named ‘skworker.’ The affected models include:
- CPE2801
- WE1026-5G-WD
- WE1326
- WE2007
- WE2008-DSIM
- WE2416
- WE3326
- WE5927
- WE5931
- WE5931AC
- WE826-T3-DSIM
- WG108
- WG1602
- WG1608-DSIM
- WG209
- WG2105
- WG2107
- WG259
- WG3526
- Z8102AX-2DSIM
Each of these models attempts to connect to a set of primary and secondary endpoints, including zbtctl.epplink[.]net (47.100.190[.]96), 47.107.224[.]89, online-string[.]com (45.32.81[.]152), and rbdg4nzqadui.wikaba[.]com (43.248.136[.]125).
In response to these findings, Zbtlink has temporarily removed the affected firmware versions from their download channels. A notice on their website states that they have detected security vulnerabilities in selected router firmware releases and are working to develop and validate secure patched firmware. Users are advised to await the release of these updates and to monitor Zbtlink’s communications for further information.
This incident underscores the critical importance of supply chain security in network hardware. Users should remain vigilant, regularly update firmware, and consider the security track record of manufacturers when selecting networking equipment. The presence of such backdoors highlights the need for thorough security audits and transparency in the development and distribution of firmware to ensure the integrity and safety of network devices.
