[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3V-d9nQTf6OrfBhXOQRpe8cV1dj-0en1bFV8eXBMFGQ":3},{"article":4,"iocs":54,"watch_terms":62,"solutions":63,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"00141cba-a785-4241-84bb-240ce904e5c4","China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access","china-made-zbt-routers-ship-with-two-implants-giving-unauthenticated-attackers-r-00d295","VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices. The implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.","VulnCheck has discovered two undocumented factory implants, SPEAKINGSTONE and DARKLANTERN, in firmware for routers manufactured by Shenzhen Zhibotong Electronics (ZBT). These implants, rated with critical CVSS scores, allow unauthenticated remote attackers to gain root access and execute arbitrary commands. SPEAKINGSTONE acts as a surveillance implant, while DARKLANTERN has ineffective authentication and can be exploited remotely. Both were found on a 2019 firmware build of a ZBT-WE826-T2 router.","China-made ZBT routers found with two factory implants granting root access.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fchina-made-zbt-routers-ship-with-two.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh0i2viN2zKBeSxzTqoxZkPNq_6lPMDBLb18zbLPwufsY4mFm494ydDDAWi6gGwy6PsmRGublHFmdmcEiGKViLuUgaJwWux_YUW7HQHuGbbf04HGNpoZa6QLmvf1IHE04TeTT89Yc1_jo0z6mptCbX-fIhVEVQzg5GnfU2Uya4HHASHbttTBGMxl7KMkbM\u002Fs1600\u002Frouter-malware.jpg","2026-08-28T10:58:29+00:00","2026-08-28T12:00:09.720518+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"Shenzhen Zhibotong Electronics","vendor",{"name":21,"type":22},"ZBT-WE826-T2","product",{"name":24,"type":22},"Zbtlink WE1326",{"name":26,"type":22},"Zbtlink WE357",{"name":28,"type":22},"Zbtlink WE5926",{"name":30,"type":22},"Zbtlink WE5926-WD","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59],{"type":56,"value":57,"context":58},"cve","CVE-2026-74232","SPEAKINGSTONE implant vulnerability",{"type":56,"value":60,"context":61},"CVE-2026-74233","DARKLANTERN implant vulnerability",[18,21,24],{"controls":64,"vendors":144},[65,94,115],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[99,107],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":116,"name":117,"problem":118,"products":119},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":162},"factory-installed-backdoors-in-zbt-routers-grant-root-access-to-unauthenticated-attackers","Factory-Installed Backdoors in ZBT Routers Grant Root Access to Unauthenticated Attackers","Two undocumented firmware implants — SPEAKINGSTONE and DARKLANTERN — were discovered pre-installed on ZBT routers manufactured by Shenzhen Zhibotong Electronics, meaning the threat arrived baked into the hardware before customers ever powered the devices on. These implants allow unauthenticated remote attackers to gain root-level access and execute arbitrary commands, representing a critical supply chain compromise at the manufacturer level. This matters because organizations often implicitly trust hardware straight out of the box, skipping firmware validation and network isolation steps that could have detected or contained the threat. The discovery highlights that supply chain integrity — not just software patching — must be a core pillar of any organization's security posture.",[150,151,152,153,154,155,156,157,158,159,160,161],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 2 – Inventory and Control of Software Assets","CIS Control 12 – Network Infrastructure Management","CIS Control 16 – Application Software Security","NIST SP 800-161 – Supply Chain Risk Management","NIST SR-3 – Supply Chain Controls and Processes","NIST CM-3 – Configuration Change Control","NIST SI-7 – Software, Firmware, and Information Integrity","NIST AC-17 – Remote Access","ISO\u002FIEC 27001 – A.15 Supplier Relationships","NIST CSF – ID.SC Supply Chain Risk Management","GDPR Article 32 – Security of Processing (for EU deployments storing\u002Ftransmitting personal data)",{}]