If you have one of these routers at home, it’s best to disconnect it immediately.

The security of the internet connection of our devices and our home starts with the router, the device through which practically all of our activity passes. Now, an investigation by VulnCheck has uncovered ENDLESSDOORS, a backdoor deliberately built into various Chinese routers, capable of contacting command-and-control servers and executing remote commands with administrator privileges.

Fing - Network Scanner Download

A connection that originates from within the network itself

According to VulnCheck, the vulnerability begins when the router is powered on, since it establishes an outbound connection with its command infrastructure. This isn’t a minor issue, because by initiating the connection from the router itself the remote access goes through NAT and standard firewalls, just as any legitimate connection would, even when the device is protected behind several network layers.

Once this connection is established the router remains on standby and ready to receive instructions. Instructions that it will execute with administrator privileges and that most users will never notice.

The devices in question come from Shenzhen Zhibotong Electronics and are sold under brands such as Zbtlink, Wiflyer, or under third-party labels, sometimes even those of certain operators.

Which models to check and what to do

It’s worth checking the label on the underside or the administration panel and locating the exact model number. The models identified so far are:

CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526 and Z8102AX-2DSIM.

If there’s a match, the safest move is to disconnect the device and replace it immediately. Afterward we can check which devices access our network, change the default password of the new router and, if we want to go a step further, review the security settings of the devices —especially the home automation ones— and the accounts we’ve used.