# CVE-2026-66747: ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant

> Zbtlink routers contain a hardcoded root backdoor that phones home to a C2 server, allowing remote code execution via network hijacking or C2 takeover.

- **Severity:** Critical 9.3 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 5 Aug 2026
- **Updated:** 5 Aug 2026
- **Also known as:** GHSA-gf5q-q6h6-j87v

## What is CVE-2026-66747?

CVE-2026-66747 is a critical vulnerability in Zbtlink CPE2801 Firmware, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.

Weakness: CWE-506 (Embedded Malicious Code)

## Which versions are affected by CVE-2026-66747?


## How do I fix CVE-2026-66747?

No fix has been published for CVE-2026-66747 yet. Limit exposure of the affected software until one is available.

## Is CVE-2026-66747 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-66747 exists.

Public exploit code:

- 내 공유기가 Zbtlink ENDLESSDOORS 백도어(CVE-2026-66747) 대상인지 클릭 한 번으로 검사하는 Windows 프로그램 (github_poc): https://github.com/oiehnow/oieh-router-checker

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-66747 and fix it if it is affected.

What it is: CVE-2026-66747 is a critical vulnerability in Zbtlink CPE2801 Firmware, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-66747 exists.

Affected product: Zbtlink CPE2801 Firmware. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-66747/ (Markdown: https://insights.sbomify.com/CVE-2026-66747/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-66747
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-66747
- OSV: https://osv.dev/vulnerability/CVE-2026-66747

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-66747/
Summaries are generated and may contain mistakes; the official description above is the record.