{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-66747 exists.","fix":"No fix has been published for CVE-2026-66747 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-66747 is a critical vulnerability in Zbtlink CPE2801 Firmware, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-66747 and fix it if it is affected.\n\nWhat it is: CVE-2026-66747 is a critical vulnerability in Zbtlink CPE2801 Firmware, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-66747 exists.\n\nAffected product: Zbtlink CPE2801 Firmware. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-66747/ (Markdown: https://insights.sbomify.com/CVE-2026-66747/index.md)","id":"CVE-2026-66747","markdown":"https://insights.sbomify.com/CVE-2026-66747/index.md","name":"CVE-2026-66747","record":{"aliases":["GHSA-gf5q-q6h6-j87v"],"analysis":{"component_type":"network_device","fix_type":"no_fix_stated","impacts":["code_execution","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"Zbtlink router firmware","requires_auth":"none","summary":"Zbtlink routers contain a hardcoded root backdoor that phones home to a C2 server, allowing remote code execution via network hijacking or C2 takeover.","user_interaction":"not_required","vuln_class":"hardcoded_credentials"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"VulnCheck","cpe":[],"cvss":{"score":9.3,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-506","name":"Embedded Malicious Code"}],"description":"Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-08-22","github_poc":1,"max_poc_stars":3,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-08-22T02:29:54Z","kind":"github_poc","ref":"https://github.com/oiehnow/oieh-router-checker","stars":3,"title":"내 공유기가 Zbtlink ENDLESSDOORS 백도어(CVE-2026-66747) 대상인지 클릭 한 번으로 검사하는 Windows 프로그램"}],"tier":"weaponised"},"has_fix":null,"headline":"ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant","id":"CVE-2026-66747","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"hardcoded_credentials","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field","id":"CVE-2026-66748"},"packages":[],"prev":{"headline":"Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection","id":"CVE-2026-66746"},"products":["CPE2801 Firmware","WE1026-5G-WD Firmware","WE1326 Firmware","WE2007 Firmware","WE2008-DSIM Firmware","WE2416 Firmware","WE3326 Firmware","WE5927 Firmware","WE5931 Firmware","WE5931AC Firmware","WE826-T3-DSIM Firmware","WG108 Firmware","WG1602 Firmware","WG1608-DSIM Firmware","WG209 Firmware","WG2105 Firmware","WG2107 Firmware","WG259 Firmware","WG3526 Firmware","ZBT-Z8102AX-2SIM Firmware"],"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Zbtlink"]},"summary":"Zbtlink routers contain a hardcoded root backdoor that phones home to a C2 server, allowing remote code execution via network hijacking or C2 takeover.","url":"https://insights.sbomify.com/CVE-2026-66747/"}