ZBT Routers Ship with Factory-Installed Implants:…

VulnCheck disclosed two factory-installed firmware implants in routers from Shenzhen Zhibotong Electronics (ZBT): SPEAKINGSTONE and DARKLANTERN. Together they grant unauthenticated remote root command execution, ISP credential theft, and DNS hijacking. Over 500 devices already observed.

VulnCheck disclosed on August 27, 2026, two factory-installed firmware implants in routers manufactured by Shenzhen Zhibotong Electronics (ZBT). SPEAKINGSTONE and DARKLANTERN allow an unauthenticated remote attacker to execute commands as root, exfiltrate ISP credentials, and hijack DNS. The disclosure breaks a vendor silence that, four days earlier, had still seen updated firmware published without any mention of the two services.

The affected routers also circulate as white-label devices: different brands, same hardware, identical firmware. The supply-chain risk therefore extends well beyond the ZBT catalog.

Key Takeaways

Two implants, SPEAKINGSTONE and DARKLANTERN, are factory-installed in ZBT firmware and assigned CVE-2026-74232 and CVE-2026-74233, both with CVSS 3.1 scores of 9.8 per VulnCheck records.
DARKLANTERN listens on UDP/9992 with the stock firewall open to the internet; authentication is bypassed via a hardcoded salt 'mqonu.com' and an all-zeros MAC address, according to the Nim code analysis published by VulnCheck.
SPEAKINGSTONE beacons outbound on UDP/10000 to a hardcoded C2 server, works behind NAT, and implements commands to steal PPPoE credentials, alter DNS, and open reverse SSH tunnels.
VulnCheck detected 203 DARKLANTERN instances exposed on the internet across 22 countries and 392 unique devices that contacted the SPEAKINGSTONE backup domain, 390 of them in China.

The Mechanism: Two Ports, Two Directions, One Goal

DARKLANTERN responds as infosrvd on UDP/9992. VulnCheck reconstructed the binary protocol: a 19-byte packet is enough to elicit a response from the service, which authenticates via an MD5 checksum calculated on the hardcoded salt mqonu.com and the MAC address. The Nim code contains an explicit bypass path: if the MAC is all-zeros, authentication is skipped. "One packet for a root shell over the internet," VulnCheck wrote in its technical blog. The service is designed to be reachable from the outside: "By design, it's reachable from the outside world."

SPEAKINGSTONE, the yunmgrd service, operates in the opposite direction. It beacons on UDP/10000 to the domain ac-link.com, resolved to the Alibaba Cloud IP 47.107.224.89 in Shenzhen. The protocol is more elaborate: cmdRun for command execution, pppoe cred exfil to extract ISP access credentials, dnsSet/dnsGet to manipulate name resolution, and reverse SSH for outbound tunnels. The structure is that of a full remote access capability, not a diagnostic tool.

Both services are written in Nim and launched by the inetdetect binary. VulnCheck found them on a Deep Orange 3G/4G/LTE router purchased in the United States for $88: a white-label of the ZBT-WE826-T2 model, with firmware dated 2019. The implant was already present at the time of purchase.

The "After-Sales" Justification and What the Code Contradicts

Last month VulnCheck had already published research on ENDLESSDOORS, another ZBT implant (CVE-2026-66747) that the parent company Zbtlink justified as an "after-sales maintenance tool." The same C2 infrastructure—ac-link.com and IP 47.107.224.89—reappears now in SPEAKINGSTONE, creating a pattern linking three distinct implants over time.

The gap between the corporate narrative and the technical capabilities is stark. VulnCheck wrote: "This is a surveillance implant with root access to every device it runs on." And further: "No one is mistaking SPEAKINGSTONE for a customer support tool. It's not a cloud management tool. Those types of tools don't steal ISP credentials. They don't hijack DNS." The code implements surveillance and control functions, not remote assistance.

The source has not issued public statements on yunmgrd or infosrvd. The firmware download page remains active with builds dated August 17, 2026, without mentioning the two services.

The Map of Exposed Devices and the Profile of the Installed Base

VulnCheck scan data paints an asymmetric distribution. For DARKLANTERN, 203 exposed instances across 22 countries between August 18 and 21, 2026, with 16 different models self-reported in probe responses. For SPEAKINGSTONE, the backup domain findmyipaddr.com—registered by researchers to capture beacons—collected 392 unique devices. Of these, 390 in China, 304 with SSIDs starting with 'CMCC' (China Mobile), 304 on the China Mobile network, representing 83% of the total sample. The predominant self-reported model is L3_V2_8 with firmware 3.0.0.4.528, in 363 cases.

The figure of 392 is a floor, not a total: it represents only devices that contacted the backup domain, not those reaching the primary C2. The true installed base is unknown. CISA had not included the three ZBT CVEs in the KEV catalog as of August 28, 2026, per verification by The Hacker News.

"One packet for a root shell over the internet" — VulnCheck

Why It Matters

The ZBT case exposes a structural problem in the low-cost CPE market: white-labeling and an invisible supply chain. Same ZBT hardware, identical firmware, different brand on the case. The danger is not readable from the vendor name on the shelf. MOFI Network, which recompiles alternative firmware for the same hardware platform, was found free of implants in the VulnCheck verification: the difference lies in the firmware, not the silicon.

The dossier does not specify whether the August 17, 2026 firmware builds still contain the implants. It is not known if Zbtlink will release patches, nor which unlisted models or firmware versions are affected. It is unclear who developed the three implants—ZBT, MoreQuick, or a third party—nor whether the domain findmyipaddr.com was originally vendor-controlled or simply unregistered and then captured. Active attacks beyond research probes are not documented.

The relevance is twofold: for enterprises with these routers in the field, the impact is immediate remote root, exfiltration of ISP access credentials, and man-in-the-middle capability via DNS. For providers and MSPs distributing white-label CPE, the issue is the verifiability of the firmware supply chain.

The Questions That Remain Open

How vast is the installed base?

The 392 sinkholed devices and 203 exposed instances are measured subsets. The source does not quantify the total affected devices globally. The real number depends on unscanned models, firmware not beaconing to the backup domain, and devices behind NAT that do not expose DARKLANTERN but run SPEAKINGSTONE.

Does the August 17, 2026 firmware fix the problem?

The dossier does not verify the content of builds after August 17, 2026. The download page is active, but no source documents that the releases mention or remove yunmgrd and infosrvd.

Are non-ZBT white-label routers at risk?

Yes, if they run identical ZBT firmware. VulnCheck found both implants on a Deep Orange router sold in the United States, a white-label of the ZBT-WE826-T2 model. Verification requires analysis of the specific firmware, not reading the external brand.

The SPEAKINGSTONE-DARKLANTERN disclosure fits a pattern VulnCheck has been tracking for months: factory-installed implants in Chinese hardware with C2 in China, justified as "after-sales support" but capable of network surveillance. The line between remote management tool and backdoor is not interpretive: when the code implements ISP credential theft and reverse SSH tunnels, the technical classification is singular. The open question is who controls those servers, and under what authorization.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter