VulnCheck has disclosed two previously undocumented factory-installed implants found in firmware of routers manufactured by Shenzhen Zhibotong Electronics (ZBT). The implants, named SPEAKINGSTONE and DARKLANTERN, are tracked as CVE-2026-74232 and CVE-2026-74233 respectively. Both implants allow unauthenticated remote attackers to execute arbitrary commands with root privileges on affected devices. The vulnerabilities were discovered by VulnCheck's zero-day research team. The fact that these implants ship pre-installed in the firmware raises serious supply chain security concerns. Affected devices are China-made ZBT routers potentially distributed globally. The unauthenticated nature of the attack vector makes these vulnerabilities particularly critical as no credentials are required for exploitation.
VulnCheck disclosed two factory-embedded implants in ZBT (Shenzhen Zhibotong Electronics) router firmware. SPEAKINGSTONE (CVE-2026-74232) runs as service 'yunmgrd' and sends UDP beacons on port 10000 to a hardcoded C2 server (www.ac-link[.]com, IP 47.107.224[.]89 on Alibaba Cloud in Shenzhen). It supports arbitrary root command execution, WAN PPPoE credential exfiltration, DNS hijack list read/write, and reverse SSH tunnel establishment. It operates behind NAT via outbound connections. A backup C2 domain (www.findmyipaddr[.]com) was found unregistered; VulnCheck registered it and observed 392 unique beaconing devices, 390 in China, 83% on China Mobile, 304 broadcasting SSIDs starting with 'CMCC', and 363 self-reporting model L3_V2_8 on firmware 3.0.0.4.528. DARKLANTERN (CVE-2026-74233) runs as service 'infosrvd' on UDP port 9992, open to all inbound internet connections by the router's stock firewall. Its authentication is bypassed via a hardcoded salt and all-zero wildcard MAC address. Between August 18-21, 203 internet-facing DARKLANTERN instances were found across 22 countries across 16 self-reported models. Both implants were found on an $88 Deep Orange 3G/4G/LTE Router (white-labeled ZBT-WE826-T2) with 2019 firmware purchased from a US supplier. Both CVEs are rated 9.3 on CVSS 4.0 and 9.8 on CVSS 3.1, requiring no privileges or user interaction over the network. VulnCheck flagged CVE-2026-74233 in its Known Exploited Vulnerabilities catalog. No fixed firmware release has been published. MAC address prefixes 78:A3:51 and F8:5E:3C are assigned to Shenzhen Zhibotong Electronics. Third-party firmware (e.g., MOFI Network) for the same platform was found free of all three implants. Suricata and YARA detection rules were published, though a discrepancy exists between port 8897 and 8898 in the rules vs. documentation.
1. Identify if you own a ZBT-manufactured device by checking the MAC address prefix against 78:A3:51 or F8:5E:3C (both assigned to Shenzhen Zhibotong Electronics). 2. Check your device model against the affected product list; model number is more reliable than brand name due to white-labeling. 3. Block inbound traffic to UDP port 9992 at the network edge to neutralize the DARKLANTERN listener while a fixed firmware is unavailable. 4. Block and alert on outbound connections to www.ac-link[.]com and IP 47.107.224[.]89 at egress and DNS resolver level. 5. Monitor for beacon traffic on UDP port 10000 outbound (SPEAKINGSTONE). 6. Monitor for processes named 'infosrvd', 'yunmgrd', and 'inetdetect' on router firmware. 7. Check for presence of files /etc/exec/cmd, /tmp/info.txt, and /tmp/yunclient.conf. 8. Treat the router's LAN as untrusted if compromise is suspected. 9. Deploy VulnCheck's published Suricata and YARA detection rules (note the port discrepancy between 8897 and 8898 in rules). 10. Consider replacing ZBT firmware with third-party alternatives (e.g., MOFI Network firmware) which were found free of the implants. 11. No fixed firmware release has been published by Zbtlink; monitor vendor advisories for patches.
www.ac-link[.]com, www.findmyipaddr[.]com, 47.107.224[.]89, UDP/9992 (DARKLANTERN inbound), UDP/8897 (DARKLANTERN responses), UDP/10000 (SPEAKINGSTONE beacons outbound), infosrvd, yunmgrd, inetdetect, /etc/exec/cmd, /tmp/info.txt, /tmp/yunclient.conf, b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818, 7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245, ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926, MAC prefix 78:A3:51, MAC prefix F8:5E:3C
