CVE-2026-66747

9.8 CRITICALpublic exploit available

Published 2026-08-05 · Updated 2026-08-05

AI risk analysis

Summary: The Zbtlink router firmware includes an embedded implant called ENDLESSDOORS that provides unauthenticated remote code execution as root over cleartext TCP to a hardcoded C2 server.
Exploitability: Exploitation is relatively straightforward due to the lack of authentication and encryption, requiring only network access to the C2 address or control of the network path.
Blast radius: If exploited, this flaw could lead to complete compromise of affected routers, allowing unauthorized parties to gain root access and potentially control the entire network infrastructure.
Prioritized remediation: Update Zbtlink router firmware to a patched version or replace the affected devices with ones from a trusted vendor.

rceauth-bypassunencryptedc2firmware

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-506

Public exploit & PoC references

https://github.com/ycsunjane/rctl

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.