ZBT Routers Found With Two Hidden Factory Backdoors Handing Attackers Full Control
Researchers at VulnCheck say firmware shipped by Shenzhen Zhibotong Electronics contains two undocumented implants that let anyone on the internet run commands as root.
Key points
- VulnCheck disclosed two undocumented implants baked into the factory firmware of routers made by Shenzhen Zhibotong Electronics (ZBT).
- The implants are named SPEAKINGSTONE and DARKLANTERN, tracked as CVE-2026-74232 and CVE-2026-74233.
- Both let an unauthenticated attacker run any command as root, meaning full control of the router without a password.
- The implants sit inside the firmware as it ships from the factory, not something added by a hacker after the fact.
- ZBT sells small business and industrial networking gear, including cellular models resold under other brand names worldwide.
Two hidden doorways were built into routers from Chinese manufacturer Shenzhen Zhibotong Electronics, better known as ZBT, and either one lets a stranger on the internet take the device over completely.
The finding comes from VulnCheck's zero-day research team, and was first detailed by The Hacker News. The implants are called SPEAKINGSTONE, tracked as CVE-2026-74232, and DARKLANTERN, tracked as CVE-2026-74233. This isn't ZBT's first appearance here: our 6 August story found VulnCheck reporting that every current Zbtlink firmware image contained an implant that handed attackers root access.
An implant, in this context, is code sitting inside the device's firmware, the built-in software that runs the router, giving an outsider a quiet way in. Because these were found in firmware straight from the factory, they weren't planted by a later hack. They were there when the box was opened.
What can an attacker actually do?
Run anything they want on the router, as the top-level administrator, without a username or password. That's what "unauthenticated remote code execution as root" means in plain English.
Once inside, an attacker can read traffic passing through the router, redirect users to fake websites, or use the device as a launchpad against other machines on the same network. For a small business, that's every email, every payment, every login potentially visible to someone else.
Who makes ZBT routers, and where do they turn up?
ZBT is a Shenzhen-based hardware maker producing Wi-Fi routers, cellular networking gear and industrial equipment. Its devices are sold directly and also rebadged by other vendors, which means the same firmware, and the same implants, can appear under a name that isn't ZBT at all.
That resale pattern is the awkward part. A buyer may not know their router is a ZBT device underneath. Owners of small business routers and industrial sensors relying on cellular connections should check the maker of the internal board, not just the sticker on the case.
The two implants at a glance
| Implant name | CVE ID | What it gives the attacker |
|---|---|---|
| SPEAKINGSTONE | CVE-2026-74232 | Unauthenticated remote command execution as root |
| DARKLANTERN | CVE-2026-74233 | Unauthenticated remote command execution as root |
Should you worry if you own one?
Assume the device is exposed until the vendor says otherwise. There's no confirmed patch, and factory-level implants can't be fixed by changing a password or toggling a setting in the web interface.
If you suspect you own an affected device: take it off any public-facing connection where possible, or put it behind a separate firewall. Disable remote management so the admin page isn't reachable from outside. Ask the reseller whether the hardware sits on a ZBT board and whether cleaner firmware exists. Watch for unusual outbound traffic, which can hint the device is working for someone else.
Regulators haven't weighed in publicly yet. The FTC has previously acted against router vendors shipping insecure devices, and CISA tracks known-exploited flaws that federal agencies must patch. Both are worth watching as this disclosure develops.
The blunt reality: factory-installed implants in resold hardware are a systemic problem, not a one-off. A vendor patch, if it arrives, won't tell you how long the door was open.
