# Chinese router vendor denies backdoor allegations Company pauses firmware downloads to address security vulnerabilities. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-08-06 - **Original article:** - **On Brifing:** https://brifing.si/s/f0f55666-f1ca-4fb9-aaac-780c77587415 ## Backdoor allegations and company response Chinese Wi-Fi router vendor Zbtlink denied allegations of backdoors in its products but temporarily halted firmware downloads to address security vulnerabilities. VulnCheck CTO Jacob Baines discovered that Zbtlink routers continuously attempted to connect to a command and control server online. The company claimed this feature was solely for after-sales maintenance and not included in mass-production units. ## Technical details of the ENDLESSDOORS backdoor The backdoor, named ENDLESSDOORS by VulnCheck, is related to a small tool called rctl uploaded to GitHub in 2015. This tool implements a simple command and control client-server system operating on port 7000. According to Baines, the backdoor runs in Linux kernel threads with root privileges. The communication lacks any security protocols, making it vulnerable to interception by anyone on the network. ## Company's contradictory statements Zbtlink initially denied any security issues but soon posted a notice on its firmware download page about detected vulnerabilities affecting select router firmware versions. The Wayback Machine's July 31 archive shows no such warning. The company also stated that customers could use their own software and supported OpenWrt open-source firmware. ## Servers contacted by the routers VulnCheck found that tested devices connected to only four different servers, with just one using a domain linked to Zbtlink. Baines described this connection as 'damning'. Router firmware presents a potential target for supply chain attacks, raising significant security concerns. ## Violation of coordinated disclosure protocols Baines bypassed standard coordinated disclosure protocols due to the exceptional severity of the issue. These protocols typically give vendors time to fix unintentional flaws. However, Baines asserts the backdoor was intentionally included and has been present across 20 models for years, making standard disclosure procedures inappropriate. ## Affected devices and distribution channels Zbtlink products are sold under various brands including ZBT, ZBTWiFi and Wiflyer on platforms like Amazon, Alibaba and Shopify. The company also offers OEM and ODM services, allowing hardware customization. This situation suggests countless devices could be at risk. VulnCheck shared technical details for identifying affected devices. ## Recommendations for users VulnCheck advises users to replace affected devices or at least move them behind strict egress controls, treating their LAN as untrusted. The company provided rules for Suricata, Snort and YARA to block connections to the routers' command servers, offering practical protection measures for concerned users. ## Industry implications and risks This incident raises important questions about consumer electronics security and supply chain risks. It may increase concerns about hardware from Chinese manufacturers. As critical network components, vulnerable routers could impact millions of users. Experts recommend examining products from other manufacturers for similar risks, highlighting broader industry implications. ## Sources covering this story - https://www.theregister.com/security/2026/08/06/chinese-router-vendor-denies-its-firmware-contains-backdoors-but-pauses-downloads-to-fix-security-issues-anyway/5283794 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._