ZBT Routers Ship With SPEAKINGSTONE and DARKLANTERN Factory Implants, VulnCheck Finds

VulnCheck has disclosed two previously undocumented factory implants buried in the firmware of routers built by Shenzhen Zhibotong Electronics (ZBT), a Chinese manufacturer whose hardware is sold around the world under other companies' names. Each implant hands an unauthenticated remote attacker the ability to run commands as root on an affected device. VulnCheck's zero-day research team named them SPEAKINGSTONE (CVE-2026-74232) and DARKLANTERN (CVE-2026-74233), and rated each 9.3 on CVSS 4.0 and 9.8 on CVSS 3.1.

The word that matters here is factory. These are not bugs an attacker planted after the fact. Per VulnCheck's supply-chain research, published August 27, both implants ship inside the firmware image as it leaves the manufacturer, on hardware that ZBT resells to companies that put their own brand on the case. That is the third set of implants VulnCheck has now documented across ZBT firmware generations, after ENDLESSDOORS (CVE-2026-66747) earlier in August. The reason a defender should care is not the exploit mechanics, which VulnCheck lays out in full. It is that the trust problem sits at manufacture, where a buyer has no visibility and no easy remedy.

What VulnCheck Disclosed

Both implants give an unauthenticated attacker root command execution, but they reach the device from opposite directions, which is what makes the pair hard to firewall away with a single rule.

DARKLANTERN is a listener. It runs as a service that the router's stock firewall opens to inbound connections from any internet address, so a device exposed to the public internet answers a stranger's probe by design. VulnCheck describes the authentication guarding that service as trivially defeated. Between August 18 and August 21, the firm's internet scanner identified 203 internet-facing DARKLANTERN instances across 22 countries, with the responding devices self-reporting 16 distinct models. That figure counts hosts that answered a probe, not devices confirmed compromised.

SPEAKINGSTONE is the opposite and, for a remote operator, the more dangerous of the two. It does not wait for a connection; it makes one, beaconing outward to a command-and-control server. Because it dials out, it keeps working from behind NAT, behind a corporate gateway, and behind ordinary egress filtering, which a plain inbound-blocking listener never could. VulnCheck's writeup catalogs what an operator with SPEAKINGSTONE access can do: execute commands, steal the credentials that authenticate the internet connection, rewrite the device's DNS to send every downstream user to attacker-controlled servers, and open a reverse tunnel back in. "This is a surveillance implant with root access to every device it runs on," VulnCheck wrote.

To measure how far SPEAKINGSTONE had spread, VulnCheck found that the implant carried a backup C2 domain that nobody had registered, bought it, and stood up a sinkhole. As of August 21, 392 unique devices had reported in, 390 of them in China, with 83 percent on a single carrier's network. VulnCheck is candid that this is a floor drawn from an unrepresentative slice: a device only reaches the backup domain when it was never configured with a primary server, so the true population is unknown and almost certainly larger.

The pattern is the story as much as any single implant. ENDLESSDOORS, SPEAKINGSTONE, and DARKLANTERN span multiple firmware generations and, by VulnCheck's account, carry the same maker's fingerprints. When VulnCheck weighed ZBT's earlier explanation that the first implant was an after-sales support tool, it pointed out that support tools do not steal ISP credentials or hijack DNS, and that none of these implants use secure communications, so anyone on the network path, not only ZBT, could reach them. Three sets of implants make a coincidence defense harder to sustain.

Why the Brand on the Box Does Not Help You

ZBT is not a name most buyers would recognize, and that is the point. The company mostly builds hardware that other firms sell under their own labels. VulnCheck traced the ZBT supply chain through FCC filings, patent records, and archived pages to resellers in the United States, Canada, Australia, the Philippines, Germany, and Russia. The implants were first found on an $88 router bought from a US supplier on Amazon: a white-labeled ZBT-WE826-T2 whose firmware was built in 2019.

This is the same structural exposure that runs under the recent policy fights over foreign-made network gear, from the FCC's move to prohibit imports of certain foreign-manufactured routers to the joint US and allied warnings that state-linked actors are targeting infrastructure routers. A backdoor set at the factory rides through every rebrand downstream, which is why a router is a piece of critical infrastructure security worth inventorying even when it carries a name you trust.

The practical consequence for a defender is that the retail brand tells you nothing. VulnCheck and The Hacker News both point to the model number and the device's own hardware address as the reliable check, because the same ZBT platform surfaces under many names. The Hacker News confirmed on August 28 that the MAC-address blocks 78:A3:51 and F8:5E:3C are both registered to Shenzhen Zhibotong Electronics, which lets an owner identify the manufacturer from the router itself rather than the label.

How to Tell If Your Build Is Affected

One practical gap sits between the advisories and a real inventory. The Hacker News notes that VulnCheck's advisory pages present the affected builds as upper bounds, while the CVE records name each firmware as a single exact build and set every other version's status to unknown. Neither document names a fixed firmware release. So an owner running a build outside the listed set is left without a published basis for deciding whether the flaw applies, which is an uncomfortable place from which to make a keep-or-replace call.

That is why the model number, not the firmware string and not the brand, is the anchor worth trusting. VulnCheck's sinkhole told the same story from the other end: of the 392 devices that phoned in, 390 were in China and most were a single carrier-deployed model, which reads as domestic hardware built for one market. The same platform, and in some cases the same implants, then surfaces on routers sold to Americans through mainstream retail. For a defender, the takeaway is not the geography. It is that a device's origin and its retail label can diverge completely, so identification has to start from the hardware itself.

VulnCheck shipped Suricata and YARA rules with the research, which give a team a way to spot the implants on the wire and in firmware images rather than waiting for the vendor to confirm a build. The Hacker News flagged one inconsistency worth catching before deployment: a rule keyed to command output references one UDP port while the accompanying text and scanner use a neighboring one. It is a small discrepancy, but the kind that turns a detection into a silent miss if it is copied without review. Test the rules against a known sample before trusting them in production.

What Network Defenders Should Verify

VulnCheck published indicators of compromise, C2 domains, ports, file hashes, and detection rules alongside the research, and those are the authoritative source for hunting. Its guidance for the earlier implant applies cleanly here: block and alert on the C2 endpoints at both the egress firewall and the DNS resolver, and treat the router's own LAN as untrusted. The high-level defender workflow looks like this.

Two details narrow the work. First, because SPEAKINGSTONE beacons outward, egress and resolver controls matter more than inbound rules for that implant. Second, because DARKLANTERN listens on a fixed inbound port, closing that port at the network edge shuts the listener while no vendor fix exists. Neither advisory names a patched firmware release, so for a confirmed device, replacement is the endpoint of this list, not a fallback.

What Is Not Confirmed

Several things being said around this disclosure run ahead of the evidence, and it is worth marking them.

• Which brands carry the implants. VulnCheck names many resellers of ZBT hardware, but flags that not all of them ship the implants. One vendor it examined, MOFI Network, builds its own firmware, and the image VulnCheck looked at was clean. Presence on a given brand has to be checked, not assumed.
• The installed base. The 203 DARKLANTERN hosts and 392 SPEAKINGSTONE devices are floors from scanning and a sinkhole, not a census. VulnCheck says the real totals are unknown and likely larger.
• Whether ZBT has responded to these two. ZBT (Zbtlink) addressed only the earlier ENDLESSDOORS implant, calling it an after-sales support tool and stating, "This component has never been used for unauthorized access." As of publication it has issued no public statement on SPEAKINGSTONE or DARKLANTERN specifically.
• Any US import action. There is no confirmed regulatory move tied to these two CVEs. Neither appears in CISA's Known Exploited Vulnerabilities catalog as of August 28, though VulnCheck lists one in its own catalog.
• Named victims. No specific compromised organization has been identified in the public reporting.

My read: trust set at manufacture is the hardest supply-chain problem there is, because every downstream control assumes the box you bought is the box you think it is. A firmware backdoor baked in before the device ever powers on defeats patching, defeats brand reputation, and defeats the buyer's due diligence, since the buyer never sees the source. VulnCheck's own conclusion is blunt on where that leaves these particular devices, and I would not argue with it: routers with implants they cannot verify or remove do not belong on a network you are trying to defend. The defensible position for a security team is to treat any unverifiable white-label router as untrusted infrastructure and to budget for its removal, not to wait for a fix that the advisories give no sign is coming.

Primary Documents

• VulnCheck, "Chinese Implants in the Supply Chain" (research writeup, IOCs, and detection rules)
• VulnCheck advisory: SPEAKINGSTONE (CVE-2026-74232)
• VulnCheck advisory: DARKLANTERN (CVE-2026-74233)
• The Hacker News: China-Made ZBT Routers Ship With Two Implants
• Dark Reading: Chinese Routers Sold Worldwide Contain Backdoors