Zbtlink routers secretly phone home to China with a root-access backdoor

Full text

TL;DR

A new report details a massive security flaw in Zbtlink-made routers.

The routers are programmed to ping a hard-coded list of servers, traced back to China.

Once connected, the routers grant full root access — no authentication required.

This past spring, the FCC announced a sweeping ban on new foreign-made routers — like the kind you use to get online with your ISP and connect all your devices to Wi-Fi. This was all done in the name of national security, but just how real of a threat do routers pose? The discovery of a new security vulnerability in some Chinese-made routers may have you looking at the FCC’s action in a slightly more sympathetic light.

Jacob Baines at VulnCheck shares his analysis of routers made by Zbtlink, sold under both that and Wiflyer branding. While neither are huge names in the router space, they’re still sold through US retailers like Amazon , and have been around for years — so, plenty of time for these devices to make some inroads on the market.