Two ZBT Router Firmware Implants Enable Unauthenticated Root Access

VulnCheck has disclosed two previously undocumented implants in firmware for routers manufactured by Shenzhen Zhibotong Electronics (ZBT). The components, named SPEAKINGSTONE and DARKLANTERN, allow an unauthenticated remote attacker to execute commands as root on affected devices.

VulnCheck assigned CVE-2026-74232 to SPEAKINGSTONE and CVE-2026-74233 to DARKLANTERN. Each issue received a CVSS 4.0 score of 9.3 and a CVSS 3.1 score of 9.8. The attack vectors are network-based and require neither privileges nor user interaction.

Outbound beaconing and exposed UDP listener

SPEAKINGSTONE runs as the yunmgrd service and sends UDP beacons on port 10000 to a hardcoded command-and-control server. Since it initiates connections from the router, the implant can operate behind NAT and ordinary outbound filtering. Its protocol supports root command execution, collection of WAN PPPoE usernames and passwords, DNS hijack-list reads and writes, and reverse SSH tunnels.

DARKLANTERN runs as infosrvd and listens on UDP port 9992. The stock router firewall opens that port to inbound traffic from any internet address. VulnCheck said the service uses a hardcoded salt and an all-zero wildcard MAC value that defeats its own address check.

Between August 18 and August 21, VulnCheck identified 203 internet-facing DARKLANTERN instances in 22 countries. Those hosts self-reported 16 models, but the figure represents devices responding to a probe, not confirmed compromises.

Firmware and model identification remain important

The implants were found on an $88 Deep Orange 3G/4G/LTE Router purchased from a US supplier. The device was a white-labelled ZBT-WE826-T2 running firmware built in 2019. ZBT hardware is also sold to resellers that apply their own branding, so model number is a more dependable identifier than the name on the enclosure.

The affected model lists include Zbtlink WE1326, WE357, WE5926, WE826-Q, WE826-T2, WE826-WD, WG108 and WG3526, alongside products sold under other labels. For SPEAKINGSTONE, VulnCheck also named L3_V2_8, ZBT-7628, ZBT-ZBT7621 and several MoreQuick models. Advisory pages show listed firmware builds as upper bounds, while the related CVE records identify exact builds and classify other versions as unknown.

VulnCheck registered an unregistered backup SPEAKINGSTONE domain and observed 392 unique devices beaconing after its server went live. Of those devices, 390 were located in China, and 363 reported the L3_V2_8 model with firmware 3.0.0.4.528. The researchers stressed that this is a floor from a limited subset, not a total count of affected routers.

Actions while firmware status is unresolved

VulnCheck published indicators including the services infosrvd, yunmgrd and inetdetect; UDP/9992 for inbound DARKLANTERN traffic; and UDP/10000 for SPEAKINGSTONE beacons. It also released Suricata and YARA rules. Zbtlink had commented publicly on the separate ENDLESSDOORS component, but had issued no public statement on yunmgrd or infosrvd at the time of reporting.

Security teams should inventory routers by model and firmware, use the ZBT-assigned MAC prefixes 78:A3:51 and F8:5E:3C as an additional ownership check, block inbound UDP/9992 at the network edge, and monitor or block the published command-and-control indicators. Until vendors establish the status of current releases, organisations should treat affected router LANs as untrusted and segment them accordingly.