More than 20 models of a Chinese-made router sold around the world ship with a backdoor that hands outsiders a route onto the local network, researchers at security firm VulnCheck said. The finding sharpens Western worries about Chinese networking hardware — worries that have already pushed U.S. regulators to restrict imports.
Named "Endlessdoors" by VulnCheck CTO Jacob Baines, the implant is built into routers sold under both the Zbtlink and Wiflyer brand names. The device reaches out on its own schedule — every 35 seconds — to a fixed IP address and a Chinese-registered domain. Nobody has to trigger it, and nothing has to be misconfigured: it arrives switched on. Whoever controls those endpoints controls the router, and from there can reach laptops, cameras, storage boxes and industrial gear sharing the network. Baines estimates at least 100,000 affected routers are deployed worldwide.
The implant runs as root without authentication or encryption, according to the technical analysis. Baines warned that even institutional buyers are exposed: "If I have it in my lab, in my lab at my university, you just invited them straight into your lab and they can roam the network as they choose. The capabilities are devastating."
On August 6, Zbtlink said it was suspending sales of the affected routers and pulling the software from its website while it develops updates. The company denied its products contain backdoors but paused firmware downloads to address unspecified security issues, The Register reported. VulnCheck advised owners to identify devices by model number rather than brand — the same circuit boards reach buyers under different names — and to replace affected devices where possible, restrict remote management and segment untrusted gear off the main network.
The discovery lands amid escalating Western scrutiny of Chinese networking equipment. The FCC blocked new authorizations for foreign-made consumer routers in March, and Texas sued TP-Link in February over alleged security risks. Existing devices are not covered by those rules, however — including, in this case, the hundreds of thousands of routers already phoning home every 35 seconds.
