Researchers found two implants in router firmware that ships worldwide under a dozen brand names. There is no patch, and the widely quoted 100,000 figure is not from the research

What the researchers found

On 27 August 2026, VulnCheck published research by Jacob Baines documenting two implants in the firmware of routers made by Shenzhen Zhibotong Electronics, which trades as Zbtlink and white-labels its hardware for resale worldwide. It is the second such disclosure from the same team in a month; a third implant, in a different component, was published on 5 August.

The device that started it was an $88 router bought from a small New York company through Amazon, identified by its FCC filing as a rebadged ZBT model. This is a supply-chain story before it is a vulnerability story: the code is in the vendor’s own firmware, started at boot by the vendor’s own binary.

Same score, very different reach

The headlines say two implants give unauthenticated attackers root access. That is exactly right about one of them and loose about the other, and the difference decides what you actually do.

Same score, different reach

DARKLANTERN (CVE-2026-74233) is a listener on UDP port 9992, and the stock firewall rule accepts it from the WAN. The researchers put it plainly: "By design, it's reachable from the outside world." A command packet passes its payload to a shell, and both of the gates protecting it fail. The integrity token is a hash using a hard-coded key, so anyone can compute a valid one. The MAC address filter contains a hard-coded bypass: if the MAC field is all zeros, the check passes. As the write-up says, that is "one packet for a root shell over the internet."

SPEAKINGSTONE (CVE-2026-74232) works the opposite way. It never listens; it beacons outbound on UDP 10000, through NAT and firewalls, to the manufacturer’s own cloud domain. Its command set includes running commands, stealing the WAN connection credentials, rewriting DNS, and opening a reverse SSH tunnel. Because the inbound channel is unauthenticated and unencrypted, the researchers note "anyone on the network path can hijack these implants." But that is the precondition: you need the C2, or the path, or an unregistered backup domain. Not a scanner and a spare afternoon.

Both give the same thing once reached. Only one is reachable by a stranger.

Why the researchers call it an implant

This is a strong claim and it belongs to VulnCheck, not to us, so it is worth showing what it rests on.

The evidence for intent, as the researchers present it

Finding	Why it points past an accident
The firewall opens UDP 9992 to the WAN by default	The listener is not merely present, it is deliberately exposed
The MAC filter passes if the address is all zeros	A check with a built-in way to skip it
The token key is hard-coded and unchangeable	Anyone who reads the binary can forge a valid command
The backup domain is split across string fragments in code	An attempt to hide it from a strings search
The beacon destination is the manufacturers own domain	The vendor cloud is the command and control endpoint
Capabilities include DNS rewriting, credential theft and reverse SSH	Not the feature set of a support tool

The CVE record for SPEAKINGSTONE carries CWE-506, Embedded Malicious Code, which is the classification for code that was put there on purpose.

Note also what the researchers do not claim. They name no state agency, no threat actor, and no evidence that any third party has exploited these implants. Their interpretation, that this is surveillance technology deployed largely inside China, rests on a sinkhole population they themselves describe as unrepresentative.

Three numbers, and one that is not theirs

203

exposed to the internet

DARKLANTERN instances answering probes across 22 countries, 18 to 21 August.

392

calling home

Devices reporting to a sinkholed backup domain, of which 390 were in China.

3

implants, one vendor

DARKLANTERN and SPEAKINGSTONE, after a third was published on 5 August.

0

in CISA KEV

None of the three appears in the catalogue, and no third-party exploitation has been shown.

Where these devices actually are

The supply chain is the difficult part, because the ZBT name is rarely on the box. The research traces the same hardware, via FCC filings and trademark records, into products sold in the United States, Canada, Australia, the Philippines, Germany and Russia, under a long list of brands including recreational-vehicle and marine wifi kit, consumer routers, and unbranded cellular equipment.

But the researchers are careful in a way the coverage has not been, and so should we be: "That isn't to say all of these contain" the implants, and one rebrander that develops its own firmware was examined and found clean. Their guidance is the practical version: match on the model number, not the logo on the case.

There is no patch, and no coordinated disclosure

Two things separate this from an ordinary advisory.

First, there is no fixed firmware. The advisories name affected builds and no remediated ones. The researchers frame it as "a device-trust problem, not a patching problem", and their advice for anything carrying real traffic is to replace the device, or at minimum put it behind strict egress control and treat its network as untrusted.

Second, they deliberately skipped coordinated disclosure, and explained why: coordinated disclosure exists to give a vendor time to fix a defect, and it assumes the vendor did not intend the behaviour. In their view that assumption does not hold, so notifying the shipper buys the device owners nothing and warns whoever operates the infrastructure. Reasonable people will disagree with that, and it is a genuine departure from norms, but it is reasoned rather than careless.

The vendor has responded only to the earlier, separate implant, describing that component as an after-sales support tool that "has never been used for unauthorized access", suspending sales of affected models and removing firmware downloads. It has made no public statement about these two.

One more caution on the exploitation claim

Both advisories state they are listed in VulnCheck’s own KEV database, which normally requires a public report of exploitation in the wild. Yet the research presents no evidence of exploitation by a third party, and CISA’s enrichment of the same records records only that a proof of concept exists, not that anyone has used it. Neither implant is in CISA’s KEV catalogue. That inconsistency is unresolved, and a briefing that repeats "known exploited" without it would be overstating the case.

What to do

The position

The instinct is to make this a story about one country’s manufacturing, and the researchers do reach that conclusion for one of the implants. The more durable lesson is narrower and applies to every cheap network device on your estate regardless of origin.

You cannot patch your way out of hardware you have no reason to trust. There is no fixed firmware here, so the entire response is inventory, network control and replacement, and every one of those depends on knowing what you actually own. The device that started this research was an $88 router bought on Amazon and sold under a name with no obvious connection to its manufacturer. That is the real exposure: not that implants exist, but that a great many organisations cannot answer the question "whose firmware is running on the box in our branch office", and the answer is not printed on the case.

Meanwhile the numbers deserve the same discipline this site applies everywhere. The researchers published 203 and 392 with explicit caveats that both are floors. A round 100,000 travelled further, faster, and belongs to nobody’s research. When a story is this serious, the temptation to inflate it is the thing most likely to get it dismissed.