Zbtlink Router Firmware (Multiple Models)
From Wiki-IoT
Security Evaluation
1. Device Security
2. System Security
3. User Authentication
Technical Specifications
Student assignment submission for IoT security assessment.
| Zbtlink Router Firmware (Multiple Models) | ||
|---|---|---|
|
Security Grade
Calculator v
|
Zbtlink Router Firmware (Multiple Models)
Brand: Zbtlink (Parent: Shenzhen Zhibotong Electronics (ZBT)) Category: Router • Model / Gen: Multiple (WE826, WE1326, WG108, etc.) Multiple (20+ models affected) Release Date: 2026-08-05 • Status: In sale Classification Date: • Official Website | |
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | No physical tamper mechanism reported; implant is embedded in firmware. |
| Known vulnerabilities | Very common | 🔗 Proof | CVE-2026-66747 (CVSS 9.3/9.8): ENDLESSDOORS remote-control implant in 20+ models. |
| Prior attacks | Rare | 🔗 Proof | No confirmed criminal exploitation campaign; implant is factory-embedded. |
| Updatability | None | 🔗 Proof | No trusted vendor-fixed firmware identified; vendor fix unconfirmed. |
| Category Score | Score: 3 / 3 | ||
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | No | 🔗 Proof | C2 channel has no authentication; any party answering at C2 address gains root. |
| Communications | No encryption | 🔗 Proof | Cleartext TCP to hardcoded C2 (ports 7000/7001); DNS/route hijack possible. |
| Storage | No encryption | 🔗 Proof | mplant persisted in firmware; no encryption or integrity protection. |
| Category Score | Score: 3 / 3 | ||
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Absent | 🔗 Proof | No user-accessible mechanism to remove or disable the implant. |
| Authentication | Absent | 🔗 Proof | Command handler passes any received string to popen() as uid=0; no auth required. |
| Brute-force protection | Absent | 🔗 Proof | Not relevant; no credentials needed to control the C2 channel. |
| Event logging | Absent | 🔗 Proof | No logging of C2 communication or command execution disclosed. |
| Passwords | Default/Common/Easy to guess | 🔗 Proof | Hardcoded fallback domain in implant; no password protection on C2 channel. |
| Category Score | Score: 3 / 3 | ||
| Property | Details |
|---|---|
| Operating System & App | OpenWrt-based Firmware (Companion App: None) |
| Hardware (CPU / GPU) | CPU: MIPS / ARM (varies by model) • GPU: None |
| Memory & Storage | Memory: Varies by model • Storage: Internal Flash |
| Power, Battery & Charging | Battery: None • Power: DC Power Adapter • Charging: None |
| Display & Camera | Display: None • Camera: None |
| Sound & Connectivity | Sound: Unknown • Connectivity: Ethernet (WAN/LAN), Wi-Fi (varies by model), Cellular (some models) |
| Physical (Dimensions & Mass) | Dimensions: N/A • Mass: N/A |
Student assignment submission for IoT security assessment.