CyberSecBulletin
CVE-2026-66747NVD status: Deferred

CPE2801 Firmware: Embedded Malicious Code

Published Updated By the CyberSecBulletin desk

CVE-2026-66747 is a critical-severity embedded malicious code vulnerability in CPE2801 Firmware from Zbtlink, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected CPE2801 Firmware versions: 22.10.09. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.79% chance of exploitation within 30 days, higher than 57% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Check which version of CPE2801 Firmware you run against the affected versions below, and install the vendor's latest release.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
ZbtlinkCPE2801 Firmware22.10.09Not stated
ZbtlinkWE1026-5G-WD Firmware21.04.07Not stated
ZbtlinkWE1326 Firmware22.02.18_1Not stated
ZbtlinkWE2007 Firmware23.08.12Not stated
ZbtlinkWE2008-DSIM Firmware23.08.11Not stated
ZbtlinkWE2416 Firmware21.03.22_1Not stated
ZbtlinkWE3326 Firmware20.09.30Not stated
ZbtlinkWE5927 Firmware22.08.10Not stated
ZbtlinkWE5931 Firmware22.05.31Not stated
ZbtlinkWE5931AC Firmware22.05.31Not stated
ZbtlinkWE826-T3-DSIM Firmware21.12.21Not stated
ZbtlinkWG108 Firmware21.08.06_1Not stated
ZbtlinkWG209 Firmware21.07.28Not stated
ZbtlinkWG259 Firmware21.03.23Not stated
ZbtlinkWG1602 Firmware23.10.11Not stated
ZbtlinkWG1608-DSIM Firmware23.03.16Not stated
ZbtlinkWG2105 Firmware22.05.30Not stated
ZbtlinkWG2107 Firmware22.09.08Not stated
ZbtlinkWG3526 Firmware22.11.01Not stated
ZbtlinkZBT-Z8102AX-2SIM Firmware7.6.7.2-25.0814_114432Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA (vulncheck.com).

Scoring systemScoreSeverityScored by
CVSS 4.09.3CriticalCNA (vulncheck.com)
CVSS 3.19.8CriticalCNA (vulncheck.com)

Official description

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Embedded Malicious Code

The product contains code that appears to be malicious in nature.

How developers prevent this class of flaw

  • Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.

More Embedded Malicious Code vulnerabilities (CWE-506)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: poc, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Embedded Malicious Code vulnerabilities

Spotted an error? Tell us.