Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells

Cybersecurity researchers have disclosed details of a "factory-shipped backdoor" implanted in at least 20 Chinese router models from Zbtlink. According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years. The backdoors are designed such that they start automatically and attempt to beacon to Chinese

Report facts: VulnCheck says more than 20 Zbtlink router models ship with a factory-installed backdoor, called ENDLESSDOORS, that starts at boot, runs as root, and phones home to hardcoded infrastructure every ~35 seconds; the disclosure says this can yield unauthenticated root shell access and broader network compromise[1][2][6][10]. RealGround analysis: this is best classified as an AI supply-chain-style hardware/firmware trust risk because the malicious functionality is embedded in vendor firmware rather than introduced by a local operator, creating downstream compromise risk for any environment that deploys the affected devices.