Skip to content
feed: live
0dayNews
CVE Record
[ CRITICAL ]CVE-2026-74232

SPEAKINGSTONE factory implant in ZBT router firmware

SPEAKINGSTONE is an undocumented factory-installed implant in ZBT router firmware granting unauthenticated remote root command execution. Disclosed by VulnCheck alongside CVE-2026-74233. CVSS 9.8.

cat cve-2026-74232.json
Vendor
Shenzhen Zhibotong Electronics
Product
ZBT routers
CVSS
9.8
EPSS (exploit probability)
0.8%
Status
unpatched
Published
Source
https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html

Is CVE-2026-74232 being exploited?

Yes, per ENISA's EU Vulnerability Database (EUVD) exploited list. It was not on CISA's KEV catalog as of our 2026-10-22 snapshot.

FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.8% (scored October 14, 2026).

Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison

CVE-2026-74232 timeline

  1. Added to EU KEV (ENISA)same day as NVD
  2. Published to NVD
  3. First 0dayNews coverage+2d

Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON

CVE-2026-74232 tracks SPEAKINGSTONE, one of two factory-installed implants discovered by VulnCheck’s zero-day research team in firmware shipped by Shenzhen Zhibotong Electronics (ZBT). The implant allows an unauthenticated remote attacker to execute arbitrary commands with root privileges.

SPEAKINGSTONE is a distinct attack path from its companion implant, DARKLANTERN (CVE-2026-74233). Both are present in ZBT router firmware as shipped and do not require any post-manufacture compromise to be present on a device.

No patch was available at time of disclosure. Network operators running ZBT hardware should isolate affected devices and monitor VulnCheck and ZBT’s official advisory channels for firmware updates addressing both implants.

Other Shenzhen Zhibotong Electronics CVEs we track

CVE / VulnerabilitySeverityCVSSEPSSAdded to KEV
CVE-2026-74233
DARKLANTERN factory implant in ZBT router firmwarewrite-up
[ CRITICAL ]9.83.4%—
Related coverage
~/articles/2026-08-29-zbt-router-factory-implants-cve-2026-74232-74233
ics ot

ZBT Routers Ship With Factory-Installed Root Backdoors

VulnCheck found two undocumented firmware implants in Shenzhen ZBT routers: SPEAKINGSTONE and DARKLANTERN, each granting unauthenticated remote root access. Both carry CVSS 9.8 scores.

read →