Chinese router maker Zbtlink Electronics announced it is suspending sales of routers found to contain a hidden backdoor and pulling the affected software from its website while it develops updates to address the issue. The suspension follows a report by the United States cybersecurity firm VulnCheck, which identified the vulnerability in at least 20 models of routers manufactured by the Shenzhen-based company. Zbtlink acknowledged the research, confirming that the flaw could allow unauthorized access and control of the device, and potentially other devices connected to the same network.
The discovery lands amid growing Western concerns about cybersecurity and the systemic risks posed by Chinese-made networking equipment. The Canadian government promptly issued a security advisory related to the routers’ vulnerability, highlighting the international scope of the threat . The incident underscores the ongoing friction in the US-China tech war, where the provenance of network hardware is increasingly viewed through the lens of national security and potential espionage.
The “Endlessdoors” Vulnerability
The backdoor, dubbed “Endlessdoors” by VulnCheck Chief Technology Officer Jacob Baines, operated by automatically connecting to a specific IP address and a Chinese-registered domain every 35 seconds. According to Baines’ analysis, whoever controlled those domains or hijacked them could have taken complete control of the router. Once compromised, the router could then be used as a pivot point to access and exploit other devices on the same local network.
Zbtlink defended the inclusion of the code, stating that it serves “solely as an after-sales technical support tool” intended to assist customers with device troubleshooting and configuration “only upon their explicit request and authorization”. The company maintained that the tool “has never been used for unauthorized access.” However, cybersecurity experts remain highly skeptical of this explanation, given the implementation details and the inherent risks of such a mechanism.
Questionable Implementation and Security Risks
Baines pointed out that Zbtlink’s explanation does not address why the tool used a name that was deliberately difficult to identify unless an investigator was specifically looking for it. Furthermore, he questioned why the company chose to implement the support tool in an insecure manner that left it highly vulnerable to hijacking by malicious third parties. The design of the backdoor, constantly beaconing out to an external server, violates fundamental security best practices for network appliances.
The immediate risk to consumers and enterprises is significant. “Routers deployed around the globe are still vulnerable to hostile takeover via the backdoor,” Baines warned. Because the vulnerability is baked into the firmware, the only effective mitigation for current users is to physically remove the Zbtlink routers from their networks and actively monitor their systems for any signs of compromise. The lack of a simple patch leaves thousands of networks exposed.
Broader Implications for Chinese Hardware
The Zbtlink incident adds fuel to the ongoing debate over the trustworthiness of Chinese technology exports. While Zbtlink is a smaller player compared to giants like Huawei or ZTE, the discovery of a hardcoded backdoor reinforces the narrative pushed by US and allied intelligence agencies that Chinese hardware presents an unacceptable supply chain risk. This event will likely be cited as justification for further restrictions on Chinese technology, expanding the scope of bans beyond critical infrastructure to encompass consumer-grade networking equipment.
As the US-China technological decoupling accelerates, incidents like “Endlessdoors” make it increasingly difficult for Chinese electronics manufacturers to operate in Western markets. The burden of proof for security has shifted entirely onto the manufacturers, and even seemingly benign technical support tools are now scrutinized as potential vectors for state-sponsored cyber operations. Zbtlink’s rapid suspension of sales indicates an awareness of the severe reputational and regulatory damage such discoveries can inflict on a brand’s global viability.
The discovery of the Endlessdoors backdoor comes at a particularly sensitive moment in the global debate over Chinese networking hardware. The United States has spent years building an international coalition to exclude Huawei and ZTE from 5G infrastructure, and the FCC’s recent draft ban on Chinese optical transceivers signals a further expansion of that effort into data center components. Each new incident involving Chinese hardware and hidden vulnerabilities reinforces the political case for these restrictions, making it progressively harder for Chinese manufacturers to argue that their products should be evaluated on technical merit alone.
For smaller companies like Zbtlink, the reputational damage from a single backdoor discovery can be existential, as enterprise and government customers in Western markets are likely to blacklist the brand entirely rather than wait for a firmware patch. The broader lesson for Chinese hardware manufacturers is that the standard for security transparency in Western markets has risen dramatically, and any ambiguity in how support tools or remote access features are implemented will now be treated as a potential national security threat.