Supply chain security concerns are mounting as **VulnCheck**'s zero-day research team has identified two potent, previously undocumented factory implants within the firmware of **ZBT** routers. These implants, dubbed **SPEAKINGSTONE** and **DARKLANTERN**, offer unauthenticated remote attackers root-level command execution capabilities. ### Critical Vulnerabilities Disclosed **VulnCheck**, acting as a CVE Numbering Authority (CNA), has assigned **CVE-2026-74232** to **SPEAKINGSTONE** and **CVE-2026-74233** to **DARKLANTERN**. Both vulnerabilities have received severe ratings: 9.3 on the CVSS 4.0 scoring system and 9.8 on CVSS 3.1. Crucially, both vectors describe network attacks requiring no privileges and no user interaction, making exploitation highly accessible. ### SPEAKINGSTONE: A Covert Surveillance Tool **SPEAKINGSTONE**, running as the `yunmgrd` service, establishes outbound connections over UDP port 10000 to a hardcoded command-and-control (C2) server. This outbound communication allows the implant to function effectively even from behind Network Address Translation (NAT) and standard egress filtering. Its sophisticated protocol supports various malicious functionalities, including: * Executing arbitrary commands as root. * Exfiltrating WAN PPPoE usernames and passwords. * Writing and reading a DNS hijack list. * Opening a reverse SSH tunnel. **VulnCheck**'s supply chain research explicitly states, "This is a surveillance implant with root access to every device it runs on." ### DARKLANTERN: Ineffective Authentication, Wide Exposure **DARKLANTERN** operates as the `infosrvd` service on UDP port 9992. Alarmingly, the router's default firewall opens this port to inbound connections from any internet address. **VulnCheck**'s advisory highlights that the service's authentication mechanism is ineffective, relying on a hardcoded salt and an all-zero wildcard MAC value that bypasses its own address check. Between August 18 and August 21, **VulnCheck** detected 203 internet-facing **DARKLANTERN** instances across 22 countries, reporting 16 distinct router models. This figure represents hosts that responded to a probe, not necessarily compromised devices.  ### Pre-existing Vulnerabilities and Affected Models Both implants were discovered on a white-labeled **ZBT-WE826-T2** router, whose firmware was built in 2019. This predates **ENDLESSDOORS (CVE-2026-66747)**, another phone-home implant **VulnCheck** disclosed on August 5, found in at least 20 **Zbtlink** router models. **CVE-2026-74233 (DARKLANTERN)** affects models and firmware builds including: * **Zbtlink** WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 on firmware 19.1101. * WE2426-C on 19.1112. * WE5926-EC_QP on 20.0516. * WF3526-P on 19.051. * CTN720-W1, LF-1541, and MT7620N on 19.1101. * WRC1 on 20.0622 (under an unidentified vendor). **CVE-2026-74232 (SPEAKINGSTONE)** affects models and firmware builds including: * **Zbtlink** L3_V2_8 on 3.0.0.4.528, WE826-T2 on 19.1101, ZBT-7628 on 1.0.0.2.007, and ZBT-ZBT7621 on 1.0.0.3.001. * **MoreQuick** MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 on 1.0.0.2.000. * AP522 on 1.0.0.2.014, AP7628, and HC5661A on 3.0.0.4.380. * APG721B on 19.0809, HK300 on 1.0.0.2.032, and MAP-N10 on 1.0.0.2.044 (under an unidentified vendor). **VulnCheck**'s advisories list these builds as upper bounds, with other versions' statuses remaining unknown. No fixed firmware releases have been named publicly. Identifying the manufacturer is crucial, as **ZBT** white-labels its hardware. The IEEE-registered MAC prefix database confirms that `78:A3:51` and `F8:5E:3C` are assigned to **Shenzhen Zhibotong Electronics**, allowing users to identify the manufacturer from their device's MAC address. ### Probing the C2 Infrastructure **SPEAKINGSTONE** contains a hardcoded backup C2 domain that it contacts if a primary server is not configured. **VulnCheck** found this domain unregistered, subsequently registered it, and set up a server running a reverse-engineered implementation of the protocol. Beacons immediately began arriving. As of August 21, 392 unique devices had reported in, with 390 located in China. 83% were on **China Mobile**'s network, 304 broadcast SSIDs starting with "CMCC," and 363 self-reported as model L3_V2_8 running firmware 3.0.0.4.528. This number is a floor, as it only counts devices reaching the backup domain.  ### Discrepancies in Exploitation Status **VulnCheck** flags **CVE-2026-74233** in its Known Exploited Vulnerabilities catalog, requiring a vulnerability to be "publicly-reported as exploited in the wild." However, **CISA**'s Vulnrichment enrichment, recorded on August 27, rates exploitation as "proof of concept." As of August 28, none of the three **ZBT** CVEs appear in **CISA**'s Known Exploited Vulnerabilities catalog. ### Indicators of Compromise (IoCs) **VulnCheck** has published the following IoCs: * **Domains:** `www.ac-link[.]com` (SPEAKINGSTONE primary C2), `www.findmyipaddr[.]com` (backup domain registered by **VulnCheck**). * **IP address:** `47.107.224[.]89` (Alibaba Cloud address in Shenzhen, primary C2). * **Ports:** UDP/9992 inbound for **DARKLANTERN**, UDP/8897 for its responses, and UDP/10000 outbound for **SPEAKINGSTONE** beacons. * **Services and paths:** `infosrvd`, `yunmgrd`, `inetdetect`, `/etc/exec/cmd`, `/tmp/info.txt`, and `/tmp/yunclient.conf`. * **SHA-256 hashes:** `b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818` (yunmgrd), `7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245` (infosrvd), and `ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926` (inetdetect). ### Mitigation and Vendor Response For the earlier implant, **VulnCheck** recommended blocking and alerting on endpoints at both egress and resolver, and treating the router's LAN as untrusted. For **DARKLANTERN**, blocking inbound traffic to UDP/9992 at the network edge is advised until a fixed release is available. **VulnCheck** has also released Suricata and YARA rules to aid detection. **Zbtlink** previously addressed the **ENDLESSDOORS** component, stating it's an after-sales technical support tool used only with explicit customer request and authorization, denying unauthorized access. However, **Zbtlink** has not issued a public statement regarding `yunmgrd` or `infosrvd`. As of August 28, **Zbtlink**'s firmware download pages were active, serving firmware images dated August 17, including builds for the **WE826-T2** and **WE2426-C**, both implicated in the new advisories. This suggests the implants may still be present in current firmware. **VulnCheck** noted that **MOFI Network**, which develops its own firmware for the same platform, provided an image free of these three implants, suggesting that custom firmware can mitigate the risk. Ghost Protocol has reached out to **Zbtlink** for comment on the presence of these components in current firmware and to **VulnCheck** for further evidence supporting its catalog listing.