Your $60 LTE router answers strangers as root

The cheap LTE router in your food truck, your job-site trailer, or your pop-up's back room probably came from a brand you had never heard of before you searched Amazon. VulnCheck published research on August 28 showing that a large family of those devices ships with two undocumented factory implants, one of which accepts commands from anywhere on the internet and runs them as root. No exploit, no authentication, no vulnerability in the usual sense. It is in the firmware on purpose.

What actually happened

VulnCheck's zero-day team analyzed firmware from Shenzhen Zhibotong Electronics (ZBT) and named two implants: SPEAKINGSTONE and DARKLANTERN. The Hacker News reports they are tracked as CVE-2026-74232 and CVE-2026-74233.

SPEAKINGSTONE runs as a service called yunmgrd and beacons to a hardcoded command-and-control host over UDP port 10000, accepting remote commands.

DARKLANTERN is worse. It runs as infosrvd, listens on UDP port 9992, and the device's default firewall explicitly permits inbound traffic to that port from the public internet. Its two protections are decorative: the command checksum uses a static hardcoded salt, and the MAC address filter is bypassed by submitting all zeroes. Anyone who can send a UDP packet gets a root shell.

Between August 18 and 21, VulnCheck counted 203 internet-facing DARKLANTERN instances across 22 countries. A sinkhole picked up 392 SPEAKINGSTONE devices, 390 of them in China. The tested firmware was built in 2019 — this has been shipping for years.

The part that makes it your problem: ZBT hardware is sold under other names. VulnCheck names WiFlyer, Cioswi, KuWFi, and CroSkylink, and identifies a "Deep Orange 3G/4G/LTE Router" bought on Amazon as a rebadged ZBT-WE826-T2, with distribution across the US, Canada, Australia, Germany, the Philippines, and Russia. ZBT told researchers the implants exist to help customers troubleshoot on request; VulnCheck found no mechanism that asks for or checks that consent.

Why your network hardware belongs in your vendor inventory

Most small businesses can name their software vendors and none of their hardware ones. That gap is where this lands. A router with a root backdoor is not a device that leaks — it is a device that hands an attacker a position inside the network, behind whatever you thought your perimeter was, next to your point-of-sale terminal, your camera NVR, and the laptop signed into your bank.

What to do, in order:

Find out what you actually bought. Check the label and the admin page for the real chipset and model — WE826, WE1326, ZBT-7628, WG3526. A house brand on the box does not tell you who built the firmware.

Block UDP/9992 inbound at whatever sits upstream, and verify from outside your network rather than trusting the router's own settings page. Do not leave the router's WAN-side management reachable at all.

Replace, do not patch. These are factory implants in 2019 firmware from a vendor that defends them. There is no update path that fixes intent. If a device carries your payment traffic, budget the replacement now.

Put network gear in the same vendor list as your SaaS. Model, firmware version, purchase date, who owns it. If a device is not on a list, nobody is going to check it when the next disclosure lands.

Sources: VulnCheck — Chinese Implants in the Supply Chain, The Hacker News.