The backdoor shipped with the box

On 5 August 2026, VulnCheck published research on a router sitting on a researcher's desk in Philadelphia. The device had not been hacked. It arrived from the factory already calling out to a command and control server, waiting for orders. The implant, named ENDLESSDOORS and tracked as CVE-2026-66747 with a CVSS score of 9.3, was present in all 21 firmware images then published on the vendor's own download page, covering roughly two years of releases across about 20 models.

The vendor is Zbtlink, a brand of Shenzhen Zhibotong Electronics, which builds cellular routers and CPE and white-labels the same hardware for resellers. The same device appears under the Wiflyer name and through OEM and ODM arrangements with anyone willing to put their own logo on the case. Zbtlink told reporters the functionality was intended for after-sales maintenance, denied it constituted a backdoor, paused firmware downloads and suspended sales of the affected models. As of publication, no fixed firmware has been released.

For anyone who buys network equipment through a tender process, this is the more uncomfortable class of problem. There is nothing to patch.

What ENDLESSDOORS actually is

The implant is a customised build of rctl, a small remote-control tool uploaded to GitHub in January 2015 and never updated since. It ships as an OpenWrt package, /usr/lib/librctl.so, started at boot by an init script named skworker, and runs as a userland process called kworker — deliberately named to blend into the bracketed [kworker/*] kernel threads that fill a normal process listing.

The protocol has no handshake, no key exchange and no encryption. On connecting, the implant sends a fixed 39-byte hello — a class label and its LAN MAC address — and everything the server sends afterwards is passed to popen() and executed as uid 0. One reserved string, rctlbash, opens a second connection on port 7001 and bridges /bin/sh over a pseudo-terminal. That is an interactive root shell.

Because the device dials out, there is no listening port to find and no inbound firewall rule to defeat. VulnCheck's proof of concept simply answered the phone: they stood up an rctl server, waited for the router to check in — reported intervals are roughly every 35 seconds — and asked for a shell. A unit behind three layers of NAT in a branch office is as reachable as one with a public IP, provided it can egress to one of the four C2 endpoints. "It is behind NAT" is not a control here, and neither a password change nor a factory reset restores trust in the device.

Romanian law covers this — narrowly

Romania already has a vendor authorisation regime. Law 163/2021 conditions the use of technologies, equipment and software in ICT infrastructures of national interest and in 5G networks on the manufacturer obtaining an authorisation, granted by prime-ministerial decision on the binding opinion of the Supreme Council of National Defence (CSAT) within four months of application. Equipment from unauthorised manufacturers had a seven-year run-off from 11 June 2021, reduced to five years for core network elements — a deadline that passed in June 2026. ANCOM enforces, with fines set between 1% and 5% of turnover.

Article 11 is the procurement hook, and it is worth reading precisely. Contracting authorities in the national defence, public order and national security system have the right to require in the tender documentation that the manufacturer be authorised under Article 3, where the contract covers equipment intended for ICT infrastructures of national interest. If they exercise that right, they must exclude any economic operator supplying products from an unauthorised manufacturer.

A right, not an obligation. Limited to one category of contracting authority. Tied to infrastructures of national interest. A county hospital buying twelve cellular routers for its remote clinics, a city hall equipping branch offices, a utility fitting out a pumping station — none of that falls inside Article 11, and in practice the tender is decided on throughput, port count, warranty and price.

What NIS 2 expects from the buyer

Article 21(2)(d) of NIS 2 requires essential and important entities to manage supply chain security, including the security of relationships with direct suppliers and the specific vulnerabilities of each supplier. Article 24 lets Member States require the use of ICT products certified under European cybersecurity certification schemes as evidence of compliance with Article 21.

In Romania, NIS 2 was transposed through Government Emergency Ordinance 155/2024, consolidated by Law 124/2025, with DNSC Orders 1/2025 and 2/2025 as the operational framework. The relevant point for procurement is that the obligation sits with the buyer. When a manufacturer ships a root implant across two years of releases, the regulator does not ask the manufacturer for the risk assessment — it asks the entity that installed the device on its network.

Separately, from 11 September 2026 the Cyber Resilience Act obliges manufacturers of products with digital elements placed on the EU market to report actively exploited vulnerabilities to ENISA and the national CSIRT: early warning within 24 hours, technical notification within 72 hours, final report within 14 days. Article 69(3) extends that duty to products placed on the market before the CRA's full obligations begin on 11 December 2027. That gives a buyer something concrete to ask for, because a supplier who cannot describe its own reporting process is telling you something useful.

The clauses to add to the tender documentation

None of the following requires a change in the law. They are ordinary technical and contractual requirements.

• Name the actual manufacturer, not the brand. Require the bidder to declare the manufacturing entity, the factory of origin and any OEM or ODM relationship. Match on model number — a rebranded device with a different logo is the same device.
• Firmware provenance and integrity. Require a published SHA-256 hash for every firmware image, require the delivered image to match it, and verify the hash at acceptance rather than trusting a delivery note.
• A written declaration of remote management and outbound connections. Every host, domain, IP and port the device contacts on its own initiative, plus an explicit statement that no undocumented remote-support channel exists. Zbtlink's own explanation — that the implant served after-sales maintenance — would have failed this clause at signature.
• A defined security support window. An end-of-security-support date, a patch SLA for critical vulnerabilities, and a notification obligation to you directly, aligned with the CRA's 24-hour, 72-hour and 14-day timeline.
• A remedy for the case where no patch exists. Replacement or buy-back at the supplier's cost where a defect cannot be fixed in firmware. This is the clause the ENDLESSDOORS owners do not have.
• A right to independent firmware analysis and audit, on a sample unit before acceptance and during the contract term.
• Certification where a scheme exists. European schemes under NIS 2 Article 24 do not cover every product category, so treat this as a preference criterion rather than a hard filter, and say so in the evaluation grid.
• An exclusion right modelled on Article 11. A contracting authority outside the defence and national security system can write an equivalent requirement into its own tender documentation, provided it is proportionate to the subject matter of the contract and stated in advance.

What to verify at acceptance, and on kit already installed

Acceptance testing for a network device usually confirms that it routes packets. The checks below take minutes per unit and would have caught this case.

1. Inventory by model number, across purchasing records, branch and remote-site kit, vehicle fleets and anything a contractor installed. Look for Zbtlink, ZBT, ZBTWiFi, Wiflyer and unbranded cellular CPE of unclear provenance.
2. Read the process list. An unbracketed kworker with a nonzero VSZ is the implant. There will be two of them.
3. Check the filesystem: /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, /etc/init.d/skworker.
4. Capture egress for ten minutes on an isolated segment. Any device that contacts a host nobody can explain fails acceptance. Alert on outbound 7000 and 7001 from infrastructure segments and on the published C2 domains at your resolver — alert, do not only block, because a blocked lookup is still evidence of an implant.

For equipment already in production, an internal penetration test is where this gets confirmed rather than assumed. Network devices are frequently excluded from internal test scope on the grounds that they are infrastructure rather than systems, and that exclusion is how a router with a root implant survives three audit cycles. In industrial and utility environments the same logic applies to OT and ICS testing, where cellular CPE and remote-site routers are often the only path between a control network and the internet.

The governance side belongs in the audit and compliance framework: who signs off on a supplier, what the tender documentation requires, and whether the acceptance record shows that anyone looked. The NIS 2 and DORA checklist is a starting point for the supply chain section.

Three things to do this quarter

• Pull your purchasing records for network equipment bought in the last three years and list the manufacturers, not the resellers. If you cannot name the factory behind a device, that is the finding.
• Add the four acceptance checks above to your reception procedure and record the result. A signed acceptance report with a firmware hash in it is evidence; a delivery note is not.
• Add the clauses above to your next tender for network equipment, and have procurement, legal and security agree the wording before the notice is published rather than during the evaluation.

The implant here was documented publicly and traced to the vendor's own build process, which is unusual. What it exposes is not: a purchasing process that evaluates price and throughput, an acceptance procedure that confirms the device works, and no point at which anyone asks what the device does when nobody is watching.

This article is general information and does not constitute legal or regulatory advice. For how NIS 2, Law 163/2021 or public procurement rules apply to your specific organisation and contracts, consult the applicable legal framework and your legal counsel.

Note on sourcing: the technical findings and indicators are VulnCheck's own research on units it purchased and tested. The device-population figures reported in the press, and the vendor's statements about intent, come from news coverage and have not been independently verified by us.

Sources: VulnCheck — ENDLESSDOORS Is Phoning Home. Pick Up.; VulnCheck advisory — ENDLESSDOORS; NVD — CVE-2026-66747; Reuters — China's Zbtlink suspends sales of routers found to contain backdoor; Law 163/2021 — Portal Legislativ; NIS 2 Directive (EU) 2022/2555; European Commission — Cyber Resilience Act reporting obligations; DNSC.