Skip to content
feed: live
0dayNews
CVE Record
[ CRITICAL ]CVE-2026-74233

DARKLANTERN factory implant in ZBT router firmware

DARKLANTERN is an undocumented factory-installed implant in ZBT router firmware granting unauthenticated remote root command execution. Disclosed by VulnCheck alongside CVE-2026-74232. CVSS 9.8.

cat cve-2026-74233.json
Vendor
Shenzhen Zhibotong Electronics
Product
ZBT routers
CVSS
9.8
EPSS (exploit probability)
3.4%
Status
unpatched
Published
Source
https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html

Is CVE-2026-74233 being exploited?

Yes, per ENISA's EU Vulnerability Database (EUVD) exploited list. It was not on CISA's KEV catalog as of our 2026-10-22 snapshot.

FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 3.4% (scored October 14, 2026).

Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison

CVE-2026-74233 timeline

  1. Added to EU KEV (ENISA)same day as NVD
  2. Published to NVD
  3. First 0dayNews coverage+2d

Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON

CVE-2026-74233 tracks DARKLANTERN, one of two factory-installed implants discovered by VulnCheck’s zero-day research team in firmware shipped by Shenzhen Zhibotong Electronics (ZBT). Like its companion SPEAKINGSTONE (CVE-2026-74232), DARKLANTERN allows an unauthenticated remote attacker to execute arbitrary commands with root privileges.

The two implants use distinct mechanisms and are assigned separate CVE identifiers, meaning both must be addressed for a device to be considered clean. Neither requires post-manufacture compromise to be present on an affected device.

No patch was available at time of disclosure. Network operators running ZBT hardware should isolate affected devices and monitor VulnCheck and ZBT’s official advisory channels for firmware updates.

Other Shenzhen Zhibotong Electronics CVEs we track

CVE / VulnerabilitySeverityCVSSEPSSAdded to KEV
CVE-2026-74232
SPEAKINGSTONE factory implant in ZBT router firmwarewrite-up
[ CRITICAL ]9.80.8%—
Related coverage
~/articles/2026-08-29-zbt-router-factory-implants-cve-2026-74232-74233
ics ot

ZBT Routers Ship With Factory-Installed Root Backdoors

VulnCheck found two undocumented firmware implants in Shenzhen ZBT routers: SPEAKINGSTONE and DARKLANTERN, each granting unauthenticated remote root access. Both carry CVSS 9.8 scores.

read →