DARKLANTERN is a firmware-resident backdoor tracked as CVE-2026-74233 that affects certain Shenzhen Zhibotong Electronics (ZBT/Zbtlink) router products, including internationally distributed OEM and white-label devices.
Profile source: Mallory opens in a new tabDARKLANTERN
DARKLANTERN is a firmware-resident backdoor tracked as CVE-2026-74233 that affects certain Shenzhen Zhibotong Electronics (ZBT/Zbtlink) router products, including internationally distributed OEM and white-label devices. It exposes a WAN-facing UDP service through the default firewall and implements an unencrypted remote-management protocol with ineffective authentication. Its token scheme relies on a static embedded value, and its MAC-address validation accepts an all-zero wildcard value, permitting unauthenticated remote access. DARKLANTERN can disclose router and network-identifying information and execute attacker-supplied shell commands with root privileges. It was identified in 2019-era firmware and has been observed across multiple ZBT router models; not all ZBT-derived firmware is known to contain it. Internet measurement identified publicly reachable instances in multiple countries, but exposure alone does not establish device compromise.
Exploited software
MITRE ATT&CK
Reporting
VulnCheck identified DARKLANTERN and SPEAKINGSTONE, two previously undocumented firmware implants in cellular routers made by Shenzhen Zhibotong Electronics (ZBT)/MoreQuick and sold internationally under ZBTlink and numerous OEM brands. Tracked as CVE-2026-74232 and CVE-2026-74233, DARKLANTERN exposes an unauthenticated UDP service on port 9992 that permits arbitrary commands as root. SPEAKINGSTONE beacons over UDP port 10000, including from devices behind NAT, and supports remote command execution, PPPoE/WAN credential theft, DNS hijacking, reverse SSH tunneling, and C2 reconfiguration; affected firmware also includes the previously reported ENDLESSDOORS implant in some models. Internet scans found 203 DARKLANTERN-exposed devices in 22 countries across at least 16 device models. After registering an abandoned SPEAKINGSTONE backup C2 domain, researchers received beacons from 392 devices, 390 of them in China and largely appearing to be China Mobile customer-premises equipment; the implant’s primary C2 domain remained active. No separate criminal exploitation campaign has been confirmed, but organizations should regard affected routers as potentially compromised, restrict inbound UDP 9992 and outbound UDP 10000 traffic, investigate connected devices, and replace hardware where feasible. ZBTlink said it suspended sales of affected routers and took related software offline while developing updates, though no confirmed vendor fix was reported.
Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.
