Undocumented Factory Implants Discovered in Shenzhen Zhibotong ZBT Routers

VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.

The implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.

According to the report, the implants are factory-level, meaning they are present in firmware from the point of manufacture. This allows unauthenticated remote attackers to gain root-level command execution without requiring prior authentication or exploiting a software vulnerability in the traditional sense. The report states that exploits are publicly disclosed as factory implants embedded in firmware; no additional vulnerability exploitation is required.

Affected ZBT router models deployed globally have been identified, though the specific geographic distribution of affected units is not specified. The impact is described as potentially enabling full device compromise, lateral movement into internal networks, and persistent backdoors on critical infrastructure.

As of the disclosure date of August 28, 2026, no official patch has been mentioned. Affected users are advised to contact Zhibotong Electronics for firmware updates, consider network segmentation, and monitor for anomalous router behavior. The veracity of the CVE assignments (CVE-2026-74232 and CVE-2026-74233) and the factory implant claims should be verified through official CNA assignments, as hardware-level implants are rare and require independent verification.