The Backdoor Wasn't In Your Smart Lock. It Was In Your Router.

A security researcher in Philadelphia has a router sitting on his desk, plugged into an isolated test network, doing nothing but phoning home. Every few seconds it tries to reach a server in China. Nobody hacked it. It shipped that way.

That router is a Zbtlink, one of twenty models a cybersecurity firm called VulnCheck found carrying the same hidden component: a piece of code that starts automatically at boot, runs with full root access, and accepts commands from anyone who answers when it calls out. No password. No handshake. No way to tell it "no."

I've written before about why I don't put automation logic on Wi-Fi. This story is the cleanest example I've seen yet of why.

What VulnCheck actually found

VulnCheck published its research on 5 August 2026. The implant, which they named ENDLESSDOORS, was found baked into every firmware image on Zbtlink's own download page, 21 images spanning more than two years of releases. Zbtlink is a Chinese manufacturer (Shenzhen Zhibotong Electronics) that builds routers and white-labels them for other companies to rebrand. The same hardware shows up on Amazon under both the Zbtlink and Wiflyer names, and through Zbtlink's own Shopify storefronts and Alibaba listings.

The component disguises itself as a Linux kernel process called "kworker" so it blends into a normal process list. It isn't one. It's an ordinary program with a real memory footprint, and it's running as root.

Here's the part that matters most: it uses no encryption and authenticates nobody. The router sends a short "hello" message with its network address to a remote server, and whatever the server sends back gets executed as root. One reserved command opens a live interactive root shell. VulnCheck tested this on their own hardware, intercepted the router's outbound call, and had a full root shell within seconds of it checking in. No exploit chain, no privilege escalation. Just answering the phone.

Because the router initiates the connection outward, it doesn't matter whether your network is firewalled or sitting behind three layers of NAT. The device is calling out, not waiting to be found. It phones home as often as every 35 seconds.

By VulnCheck's own account, affected units are already running in homes, offices, and vehicles around the world. Independent reporting on their findings puts the number at well over 100,000 devices deployed.

Why researchers didn't wait for a patch

Normally, when researchers find a flaw like this, they quietly tell the vendor and give them time to fix it before going public. VulnCheck skipped that step here. Their reasoning: coordinated disclosure assumes the vendor didn't mean to build the flaw in. A component that starts at boot, ships across twenty product lines, and survives two years of firmware updates isn't an accident in the way a buffer overflow is. There was nothing to coordinate.

Zbtlink's own response, given to journalists after the story broke, was that the component is a legitimate remote management feature, used only for after-sales support with the customer's authorisation, and never for unauthorised access. To their credit, they didn't just deny it and move on. They pulled the affected firmware from their download page and suspended sales of the flagged models while they work on a fix. That's a more responsible reaction than a lot of vendors manage once caught. But whether the original intent was innocent or not, the design itself isn't defensible: no authentication, no access control, a live root shell available to anyone who asks.

There is still no patched firmware as I write this, and by VulnCheck's own later assessment, there may never be one worth trusting. Their advice to anyone running one of these routers isn't "wait for an update." It's "treat this as a device you can no longer trust, and replace or isolate it."

It got worse three weeks later

On 27 August, VulnCheck published a follow-up. Tracing the same manufacturer's supply chain, they bought an unrelated router from a different US reseller, an older budget cellular model, and found it carried two more implants: SPEAKINGSTONE and DARKLANTERN. Different products, different backdoors, same source.

DARKLANTERN doesn't even need an outbound connection to work against you. It listens directly on the internet, and the router's own default firewall lets that traffic straight through. Its two supposed safeguards, a checksum and a device address check, both have bypasses built into the code itself. SPEAKINGSTONE goes further again: beyond a root shell, VulnCheck found it can hijack your DNS, pull the login credentials your router uses to authenticate with your ISP, and open a remote access tunnel, all from a server nobody but the manufacturer controls.

Tracing the hardware took VulnCheck through a maze of rebranded routers sold across the US, Canada, Australia, the Philippines, Germany and Russia, under names most buyers have never heard of and would have no reason to connect back to the original factory. Not every rebrand carried the implants. One reseller's own custom firmware came back clean. But that is exactly the point: you can buy a router under a brand name that means nothing, built on hardware and firmware you have no way to trace, and only find out later it was never fully yours to trust.

The part of the smart home nobody audits

Every conversation about smart home security I read focuses on the visible device: the camera, the lock, the plug. This story is about the one piece of hardware that sits upstream of literally everything else in the house, your banking app, your work laptop, your kids' tablets, and every Wi-Fi smart bulb and thermostat you own, and almost nobody thinks to question it.

The router is the one device in the house that's supposed to be the trusted boundary between "inside" and "outside." This story shows what happens when that boundary itself ships compromised.

This isn't unique to one brand or one country of manufacture. Any general-purpose router running closed firmware you can't inspect is asking you to trust a supply chain you have no visibility into. Zbtlink just happens to be the one that got caught this month.

One local note: the exact category of device flagged here, cheap dual-SIM 4G/5G routers, is popular in South Africa for exactly the reason you'd expect, backup connectivity when fibre or Wi-Fi drops. If your household picked one up off a marketplace listing during a rough patch of load shedding or network trouble, it's worth checking your model against VulnCheck's published list.

What this actually means for how a home should be wired

I'm not going to pretend KNX makes this problem disappear entirely. If your home automation logic runs on a Home Assistant box, a 1Home bridge, or anything else that talks IP, it still depends on a router somewhere in the chain, and that router still needs to be a device you can trust.

What KNX changes is how much of your home depends on that trust holding. Lighting, blinds, climate, security zones, geyser control, all of it runs on its own dedicated bus, a physically separate wired network that has nothing to do with your internet router and nothing to expose to it. A compromised router doesn't get anywhere near your lighting bus, because there's no path between the two unless someone deliberately builds one.

Where IP is unavoidable, and it usually is somewhere in a modern install, the answer isn't to avoid it, it's to fence it off properly. A dedicated VLAN for automation traffic, a firewall between that VLAN and the general household network, and a router you've actually chosen rather than whatever your ISP handed you in a box. That's not a KNX-specific recommendation, it's KNX Association's own published guidance for anyone running KNX IP on a network at all.

This isn't a reason to be afraid of your router. It just means the fewer critical functions in your home depend on trusting a black box you didn't choose and can't inspect, the fewer stories like this one will ever apply to you.

Just a conversation about what the project needs.

wayne@knxlogic.co.za | 082 564 3982 | www.knxlogic.co.za