As reported by The Hacker News, VulnCheck has disclosed two additional factory-installed implants in routers manufactured by Shenzhen Zhibotong Electronics (ZBT), bringing the total to three such discoveries in August 2026 alone. This is no longer a vulnerability story — it is a supply chain integrity crisis.
What distinguishes SPEAKINGSTONE and DARKLANTERN from typical router CVEs is that neither is a coding defect or an oversight. They are purpose-built surveillance and control capabilities compiled into factory firmware, shipped to global distributors, and sold through normal retail channels — including to U.S. customers. The $88 router VulnCheck purchased from a domestic supplier was running 2019 firmware with both implants intact. That means these capabilities have been fielded for years.
Vulnerability Details
| Identifier | Implant Name | CVSS 3.1 | CVSS 4.0 | Vector | Patch Available |
|---|---|---|---|---|---|
| CVE-2026-74232 | SPEAKINGSTONE | 9.8 (Critical) | 9.3 | Network, no privileges, no user interaction | No |
| CVE-2026-74233 | DARKLANTERN | 9.8 (Critical) | 9.3 | Network, no privileges, no user interaction | No |
Key Technical Characteristics
- SPEAKINGSTONE (yunmgrd): Outbound C2 over UDP 10000. Supports remote command execution as root, WAN PPPoE credential exfiltration, DNS hijack list management, and reverse SSH tunneling. Functions behind NAT — egress filtering on UDP 10000 is the only network-level mitigation.
- DARKLANTERN (infosrvd): Inbound listener on UDP 9992, opened by the stock firewall to any internet address. Authentication is effectively bypassable via a hardcoded salt and an all-zero wildcard MAC value. 203 internet-facing instances were identified across 22 countries.
Known Affected Models (Partial List)
DARKLANTERN: WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, WG3526 (fw 19.1101); WE2426-C (fw 19.1112); WE5926-EC_QP (fw 20.0516); WF3526-P (fw 19.051); CTN720-W1, LF-1541, MT7620N (fw 19.1101); WRC1 (fw 20.0622).
SPEAKINGSTONE: L3_V2_8 (fw 3.0.0.4.528), WE826-T2 (fw 19.1101), ZBT-7628 (fw 1.0.0.2.007), ZBT-ZBT7621 (fw 1.0.0.3.001), MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, MQAP-7628.
No firmware patch exists for either implant. The affected firmware is the supply chain artifact itself — there is nothing to update to. The only remediation is device replacement.
Why This Matters Beyond the CVEs
The ENDLESSDOORS disclosure on August 5, followed by SPEAKINGSTONE and DARKLANTERN on August 28, establishes a clear pattern: ZBT firmware has shipped with multiple, independent, purpose-built backdoors across different firmware builds and models. When a single vendor produces three distinct implants in three weeks of researcher scrutiny, the reasonable conclusion is that this is systematic — not a rogue developer or a single compromised build pipeline.
For defenders, this reframes the risk calculus. Traditional vulnerability management assumes a trustworthy vendor who will eventually ship a fix. Here, the vendor is the threat. There is no patch trajectory. No CVE to track to closure. The firmware is designed to betray you.
Who Is Most Exposed
Shield53 Recommendations — Immediate Actions
- Inventory and identify: Search asset management systems, procurement records, and network scans for any ZBT, Zbtlink, or MoreQuick-branded routers. Cross-reference against the affected model list above. Do not assume rebranded units are safe — check firmware build strings and open ports.
- Isolate immediately: Move any identified ZBT devices to a quarantined VLAN with no access to internal resources. Treat them as compromised by default.
- Block C2 channels: At minimum, block outbound UDP 10000 and inbound UDP 9992 at the perimeter. Note that SPEAKINGSTONE's outbound beacon will traverse NAT, so egress filtering is required — not just ingress rules.
- Check for indicators of compromise: Look for processes named
yunmgrdorinfosrvd, outbound UDP 10000 traffic, inbound UDP 9992 connections, and unexpected SSH tunnels. Review DNS logs for signs of DNS hijacking. - Replace, do not patch: There is no trustworthy firmware to install. Plan replacement with networking equipment from vendors with established security track records. Factor in the cost of compromised PPPoE credentials — rotate any credentials that passed through these devices.
- Rotate exposed credentials: WAN PPPoE usernames and passwords, admin credentials, and any VPN or tunnel configurations that transited these devices should be considered compromised and rotated.
- Expand supply chain vetting: Add firmware integrity requirements to procurement criteria. For edge devices, prefer vendors that publish firmware bill of materials (FBOM) or support signed firmware verification. Budget-tier networking gear from unverified manufacturers should require explicit security review before deployment.
The broader lesson is uncomfortable but necessary: the threat model for edge networking hardware must now include the manufacturer. Three implants from one vendor in one month is not a coincidence — it is a warning about the cost of trusting opaque supply chains with your network perimeter.
