ZBT Routers Ship With Factory-Installed Root Backdoors

Firmware doesn’t have to be broken to be dangerous. In the case of routers built by Shenzhen Zhibotong Electronics (ZBT), VulnCheck’s zero-day research team found something more troubling than a bug: two factory-installed implants that were never meant to be documented.

The implants, named SPEAKINGSTONE and DARKLANTERN, are tracked as CVE-2026-74232 and CVE-2026-74233, each scoring CVSS 9.8 (critical). Both give an unauthenticated remote attacker the ability to execute arbitrary commands as root on affected devices. No login required. No local network adjacency required. They are present in the firmware as shipped from the manufacturer.

VulnCheck disclosed the vulnerabilities on August 28, 2026, describing both as “previously undocumented,” which is precise language for: nobody asked for them, nobody published a spec, and they are not part of any documented feature set.

What the Implants Do

SPEAKINGSTONE and DARKLANTERN are separate attack paths, which is why VulnCheck assigned each its own CVE identifier. They are distinct mechanisms: patching one without the other leaves the device fully compromised. Both paths allow an unauthenticated remote attacker to execute commands as root, without chaining, without credentials, and without user interaction.

The affected hardware is manufactured by Shenzhen Zhibotong Electronics and sold under the ZBT brand. ZBT routers are common in industrial, small-office, and edge-networking deployments. In segments where a root-capable network device sits between zones or at a perimeter, the operational risk is significant.

Why Factory-Level Implants Are Different

Post-manufacture compromise can be traced to an infection event. Factory-installed code cannot. Every device built on the same firmware image carries the same functionality, whether or not any attacker has ever touched it. Either the hardware you purchased is clean or it is not. For ZBT devices with SPEAKINGSTONE and DARKLANTERN in their firmware, the answer is currently: not clean.

This is not an isolated pattern. Android-based car infotainment units were compromised at the factory level in a supply-chain attack documented earlier this month, with implanted code enrolling devices in a botnet before they reached end users. The lesson is consistent: hardware provenance has to be part of the risk model before a device is powered on.

The CISA red-team assessment published last week documented how lateral movement through trusted network infrastructure can compromise critical systems without triggering endpoint detections. A backdoored router at a network boundary is exactly the kind of persistent access that assessment described.

What to Do

If your environment includes ZBT-branded routers or other Shenzhen Zhibotong Electronics hardware:

Isolate and audit. Identify all ZBT devices in your environment. Segment them from sensitive zones and treat them as untrusted until a clean firmware version is available and independently verified.

Monitor for patches. VulnCheck has coordinated disclosure under CVE-2026-74232 and CVE-2026-74233. Watch VulnCheck’s advisories and ZBT’s official channels for firmware updates. Apply any patch only after confirming it removes the implanted code, not merely the named behavior.

Consider replacement for critical positions. Where ZBT hardware sits at OT/ICS perimeters, in industrial control segments, or anywhere it functions as a trusted boundary device, replacing it with hardware from a verified supply chain is the operationally defensible choice. The CVSS 9.8 severity on both CVEs reflects what unauthenticated remote root access built into firmware actually represents.

There is no workaround that removes code from firmware you do not control. The mitigation path here runs through isolation, patch monitoring, and, for high-risk placements, replacement.