Hidden Backdoor in Zbtlink Routers Connects to Servers in China

Cybersecurity researchers at VulnCheck have uncovered a built-in backdoor in the firmware of 20 router models made by Chinese manufacturer Zbtlink. The implant automatically establishes contact with cloud servers in China, potentially giving the company access to other devices on the router's network, according to Jacob Baines, chief technology officer at VulnCheck.

"When you take your router and plug it into your network, it tries to reach out to a server in China that can then fully control that router," Baines said. He noted that this discovery is a rare case where the malicious implant does not require user mistakes, such as exposing the device to the internet.

The finding adds weight to long-standing concerns among cybersecurity experts and lawmakers that routers from China cannot be trusted. Similar fears have already led to legal action and restrictions. In February, Texas sued TP-Link, a company founded in China but now headquartered in California, alleging its routers are used by the Chinese government to launch cyberattacks in the US. In March, the Federal Communications Commission imposed a blanket ban on the sale of new foreign-made routers, though it later granted exemptions to several non-Chinese manufacturers. No such backdoor has ever been found in TP-Link's routers.

Zbtlink routers are sold worldwide under both the Zbtlink and Wiflyer brands, including on platforms like Amazon. According to Baines, they are primarily deployed in business environments rather than home networks, with an estimated 100,000 units currently in use globally. The VulnCheck report notes that the true number of affected devices may exceed the 20 models examined.

Baines also highlighted the common practice of white-labeling among Chinese manufacturers, where devices are rebranded to appear as products from other countries. "They look like they're from South Korea or Germany, but really they were made in China by this one company," he said. "And they could be using that firmware. We just don't know." Zbtlink did not respond to a request for comment.