🔴 Critical | Source: The Hacker News
At least 20 router models from Chinese manufacturer Zbtlink have been found to ship with a pre-installed backdoor that grants unauthenticated root-level access. The backdoor is present across all 21 firmware images available from the vendor, spanning over two years of production, and automatically beacons to external infrastructure. This represents a supply chain compromise affecting any organisation using these devices, as the backdoor is baked in before the hardware reaches the customer.
Security Architect’s Take: Audit your network inventory immediately for any Zbtlink router models and treat them as fully compromised; isolate or replace affected devices and do not attempt to remediate via firmware update alone, as the implant is factory-shipped. If these devices are used in any network segment with cloud connectivity, review access logs for unexpected outbound traffic and rotate any credentials that may have been exposed.
Original advisory: Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells