Zbtlink denies backdoor claims amid firmware download pause

Chinese Wi-Fi router vendor Zbtlink has denied allegations of backdoors in its products, but has temporarily paused firmware downloads due to unspecified security vulnerabilities. The accusations of a built-in backdoor, dubbed "ENDLESSDOORS," were made by threat intelligence platform VulnCheck, according to The Register.

VulnCheck CTO Jacob Baines claims that Zbtlink routers are intentionally designed to communicate with command and control servers, a feature he calls a "phone-home trojan horse." Baines stated that the rctl (remote control Linux) tool, found on GitHub since 2015, allows for simple command and control communication without robust security measures like handshakes or key exchanges. He further noted that the communication is unencrypted and can be hijacked by anyone along the network path.

Zbtlink has responded by stating that the feature is for after-sales maintenance and not included in mass-produced units, though their download page has since acknowledged "firmware security vulnerabilities." The company also highlighted its specialization in OEM/ODM services, where customers often use their own custom software. VulnCheck advises users to replace affected devices or implement strict network controls.

Source: The Register