Executive brief
Multiple Zbtlink and rebranded router models contain a hardcoded backdoor implant that listens on an exposed UDP port and accepts unauthenticated commands over cleartext. An attacker on the internet can send specially crafted packets to execute arbitrary shell commands as root, modify DNS settings, steal PPPoE credentials, and establish reverse SSH tunnels—compromising the entire network behind the router and potentially enabling lateral movement to connected systems.
Technical details
The backdoor service (internally called "DARKLANTERN" and shipped as infosrvd) listens on UDP port 9992 and processes two packet types: an info probe (no auth, responds with model/MAC/IP/firmware version) and a command packet (executes shell strings via system() with no filtering). Command packets are gated by a trivial four-byte MD5-based checksum using a hardcoded salt ("mqonu.com") that any attacker can forge, and a MAC address filter that contains an intentional bypass: sending a zero MAC address bypasses the check entirely. The firewall on affected routers explicitly permits UDP 9992 inbound from the internet. No authentication, encryption, or challenge-response is used; a single 19-byte info probe immediately fingerprints the device and leaks its identifying information.
Affected products
- Zbtlink L3_V2_8 3.0.0.4.528
- Zbtlink WE826-T2 19.1101
- Zbtlink ZBT-7628 1.0.0.2.007
- Zbtlink ZBT-ZBT7621 1.0.0.3.001
- MoreQuick MQAC-7620 1.0.0.2.000
- MoreQuick MQAC-7620A 1.0.0.2.000
- MoreQuick MQAP-7620 1.0.0.2.000
- MoreQuick MQAP-7620A 1.0.0.2.000
- MoreQuick MQAP-7628 1.0.0.2.000
- Zbtlink AP522 1.0.0.2.014
- Zbtlink AP7628 3.0.0.4.380
- Zbtlink HC5661A 3.0.0.4.380
- Zbtlink APG721B 19.0809
- Zbtlink HK300 1.0.0.2.032
- Zbtlink MAP-N10 1.0.0.2.044
Timeline
- 2026-08-27: disclosed
- exploited: Hundreds of internet-facing instances observed beaconing to hardcoded C2 servers; 203 instances identified across 22 countries by August 21, 2026