Zbtlink L3_V2_8 firmware 3.0.0.4.528

CVE-2026-74232, dubbed SPEAKINGSTONE by VulnCheck researcher Jacob Baines, is a factory-installed implant (yunmgrd service) embedded in firmware for Zbtlink (Shenzhen Zhibotong Electronics) routers and white-label derivatives. It beacons outbound over UDP/10000 to a hardcoded C2 server (ac-link[.]com → 47.107.224.89, Alibaba Cloud Shenzhen) using a trivial XOR-obfuscated protocol with no authentication or encryption. The C2 can instruct the implant to execute arbitrary commands as root (msg 0x2507), exfiltrate PPPoE credentials (0x2502), inject DNS hijack entries (0x230b), or open reverse SSH tunnels (0x2405). Affected firmware: Zbtlink L3_V2_8 3.0.0.4.528, WE826-T2 19.1101, ZBT-7628 1.0.0.2.007, ZBT-ZBT7621 1.0.0.3.001, plus MoreQuick MQAC/MQAP series and several additional OEM variants.

The vendor CVSS of 9.8 CRITICAL is entirely appropriate — and if anything undersells the situation. This is not a bug; it is a deliberate, factory-installed surveillance implant that ships active in every affected firmware build. There is zero friction: no exploit chain, no user interaction, no privilege escalation needed. The implant is already running as root and beaconing outbound the moment the device powers on. The only limiting factor is the small global installed base (~392 devices observed beaconing to a sinkholed C2 domain). For any enterprise that discovers one of these devices on its network, the situation is a confirmed compromise, not a theoretical risk.

Why this verdict

• Zero-friction backdoor: No exploit development, delivery, or privilege escalation required. The implant is factory-installed, starts at boot, and runs as root. The 'attack path' is: plug in the router.
• Active C2 infrastructure: The primary C2 server (ac-link[.]com on Alibaba Cloud) was confirmed active at disclosure. 392 devices were observed beaconing to the sinkholed fallback domain in a 3-day window. This is not a dormant capability.
• Role multiplier: The affected component is a network perimeter router — 100% of units are deployed at the network edge by definition. Compromise of this device gives the attacker a beachhead behind all downstream firewalls, visibility into all transit traffic, ability to hijack DNS for all LAN clients, and a pivot point into the internal network. Blast radius = network-wide for every site using an affected router.
• Supply-chain vector: The implant is compiled into firmware distributed through Amazon, Newegg, AliExpress, and legitimate resellers (Lippert Components, Wave WiFi, OneX, MOFI). White-labeling under 6+ brand names (WiFlyer, Cioswi, KuWFi, CroSkylink, WORDFI, HomeMyfi) means asset inventory may not identify affected devices by the Zbtlink name.
• No remediation available: No clean firmware exists. The vendor paused downloads but has not published a fix. The only remediation is hardware replacement, which extends exposure duration.

Why not higher?

CVSS 9.8 is effectively the ceiling for a single-host vulnerability without Scope change. The implant does not directly propagate to other devices (no worm capability), so a 10.0 is not warranted. The CVSS vector accurately captures the severity.

Why not lower?

Despite the small observed installed base (~392 beaconing devices), this cannot be downgraded below CRITICAL. The affected component is canonically a network edge device (100% of units are perimeter routers), the implant is a deliberate supply-chain backdoor with active C2, and there is literally zero exploitation friction. White-label distribution through major e-commerce platforms means enterprise procurement teams may have acquired these unknowingly, especially for branch offices, OT sites, or temporary deployments. The lack of any available patch further sustains the rating — affected organizations cannot remediate, only replace.

1. Inventory all network equipment for affected Zbtlink/MoreQuick models and white-label derivatives immediately — Search asset inventory, procurement records, and expense reports for Zbtlink, ZBT, WiFlyer, Cioswi, KuWFi, CroSkylink, WORDFI, HomeMyfi, MoreQuick, and Deep Orange branded routers. Physical walkthroughs of branch offices, warehouses, and OT sites may be necessary. Complete within 3 days per noisgate mitigation SLA for CRITICAL.
2. Disconnect and replace any identified affected devices — There is no clean firmware. The only remediation is physical removal and replacement with a trusted vendor's equipment. Treat any discovered device as actively compromised — assume credential theft and DNS manipulation have occurred. Replace within 3 days of discovery.
3. Block C2 domains and IPs at DNS resolvers and perimeter firewalls — Block resolution of ac-link[.]com and findmyipaddr[.]com; block outbound traffic to 47.107.224.89. Apply to all DNS resolvers and egress firewalls. This degrades but does not eliminate the implant (it still runs locally as root). Deploy within 3 days.
4. Rotate all credentials that transited the affected router — The implant can exfiltrate PPPoE credentials and intercept all traffic. Rotate ISP credentials, VPN keys, and any passwords or tokens that traversed the router in cleartext or via DNS-hijackable authentication flows. Begin immediately.
5. Audit DNS resolution for signs of historical hijacking — Compare historical DNS logs for LAN clients behind the affected router against known-good baselines. Look for unexpected A/AAAA record changes that could indicate the DNS hijack capability (msg 0x230b) was used.

Run this from any host on the same LAN as the suspect router, or from a scanning workstation with UDP connectivity. Requires nmap or basic nc/timeout utilities. Example: bash check_speakingstone.sh 192.168.1.1

#!/bin/bash\n# check_speakingstone.sh - Detect SPEAKINGSTONE (CVE-2026-74232) implant\n# Usage: bash check_speakingstone.sh <ROUTER_IP>\n# Requires: bash, curl/dig, timeout, nc (netcat)\n# Run from: any host with network access to the target router\n\nset -euo pipefail\n\nROUTER_IP=\"${1:-}\"\nif [ -z \"$ROUTER_IP\" ]; then\n  echo \"Usage: $0 <ROUTER_IP>\"\n  exit 3\nfi\n\nVULN=0\n\n# Check 1: DNS resolution of known C2 domains from the router's perspective\necho \"[*] Checking for C2 domain indicators...\"\nfor domain in ac-link.com findmyipaddr.com; do\n  if dig +short \"$domain\" 2>/dev/null | grep -q \"47.107.224.89\"; then\n    echo \"[!] C2 domain $domain resolves to known implant IP\"\n    VULN=1\n  fi\ndone\n\n# Check 2: Probe UDP/9992 for DARKLANTERN (sister implant, often co-present)\necho \"[*] Probing UDP/9992 for DARKLANTERN sister implant...\"\nDL_PROBE=$(printf '\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00')\nRESPONSE=$(echo -ne \"$DL_PROBE\" | timeout 3 nc -u -w2 \"$ROUTER_IP\" 9992 2>/dev/null || true)\nif [ -n \"$RESPONSE\" ]; then\n  echo \"[!] DARKLANTERN (UDP/9992) responded - device likely has SPEAKINGSTONE too\"\n  VULN=1\nfi\n\n# Check 3: Check if router web interface matches known ZBT fingerprint\necho \"[*] Checking web interface for ZBT fingerprint...\"\nWEB=$(curl -sk --connect-timeout 5 \"http://$ROUTER_IP/\" 2>/dev/null || true)\nif echo \"$WEB\" | grep -qi \"wk-login-html\\|zbtlink\\|zbt-\\|mqonu\"; then\n  echo \"[!] Web interface matches known Zbtlink/MoreQuick fingerprint\"\n  VULN=1\nfi\n\n# Check 4: Look for outbound UDP/10000 traffic (run on upstream firewall/monitor)\necho \"[*] Note: For definitive SPEAKINGSTONE detection, monitor for outbound\"\necho \"    UDP/10000 traffic from $ROUTER_IP to 47.107.224.89 on your firewall.\"\n\nif [ \"$VULN\" -eq 1 ]; then\n  echo \"\"\n  echo \"VULNERABLE - Device shows indicators of Zbtlink implant presence.\"\n  echo \"ACTION: Disconnect immediately and replace hardware.\"\n  exit 1\nelse\n  echo \"\"\n  echo \"UNKNOWN - No positive indicators found, but SPEAKINGSTONE uses\"\n  echo \"outbound-only UDP/10000 which cannot be probed remotely.\"\n  echo \"Verify device make/model physically and check firmware SHA256.\"\n  exit 2\nfi

Sources

1. VulnCheck Blog — DARKLANTERN & SPEAKINGSTONE Analysis
2. VulnCheck Advisory — ENDLESSDOORS (CVE-2026-66747)
3. The Hacker News — China-Made ZBT Routers Ship With Two Implants
4. The Register — Chinese router vendor denies backdoors
5. Canadian Centre for Cyber Security — Zbtlink Advisory AV26-779
6. Security Boulevard — VulnCheck Warns of Zbtlink Backdoor
7. CyberSecurityNews — Zbtlink Hidden Backdoor Affecting 20+ Models