100K Routers Backdoored: Chinese-Made Zbtlink & Wiflyer Devices Hide 'Endlessdoors' Covert Access

For security operations teams, the discovery of 'Endlessdoors' isn't just another firmware bug—it's a supply chain time bomb hidden in plain sight. The backdoor's autonomous callback to a handful of domains effectively hands attackers a persistent, unauthorized beachhead inside the network perimeter, bypassing all user awareness and traditional ingress filters. This incident demands immediate asset discovery, outbound traffic auditing, and a hard look at the procurement pipelines that allowed such hardware into sensitive environments.

Cybersecurity firm VulnCheck has uncovered a hardcoded backdoor, dubbed 'Endlessdoors,' in more than 20 models of Chinese-manufactured wireless routers sold globally under the Zbtlink and Wiflyer brands. The backdoor, found by VulnCheck Chief Technology Officer Jacob Baines, automatically initiates outbound connections to a small, fixed set of command-and-control domains. Whoever controls those endpoints can take full control of the router and, from there, pivot into connected internal networks. This discovery underscores the escalating supply chain threat posed by low-cost networking equipment with opaque firmware, affecting an estimated 100,000 devices worldwide.

“

Cybersecurity firm VulnCheck has uncovered a hardcoded backdoor, dubbed 'Endlessdoors,' in more than 20 models of Chinese-manufactured wireless routers sold globally under the Zbtlink and Wiflyer brands.

The affected routers are produced by Shenzhen Zhibotong Electronics Co., a manufacturer with limited transparency into its supply chain and software provenance. Baines’ research reveals that the backdoor is not a sophisticated zero-day exploit introduced by a third party but rather a deliberate, built-in mechanism that phones home without any user interaction or configuration. Once the router connects to the internet, it reaches out to a predefined set of endpoints. If an adversary controls those domains or intercepts the traffic, they gain persistent, remote administrative access. This access allows them to monitor traffic, inject malicious payloads, intercept credentials, and move laterally across the network—potentially accessing computers, smartphones, IoT devices, and sensitive data. Baines stated, 'If I have it in my lab, in my lab at my university, you just invited them straight into your lab and they can roam the network as they choose. The capabilities are devastating.'

The vulnerability sits at the intersection of consumer-grade hardware and enterprise-risk exposure. Small businesses, home offices, and even academic labs frequently purchase these affordable routers online without vetting their security posture. The backdoor’s silent operation means that network administrators and users receive no alerts or indicators of compromise. Because the outbound connection masquerades as ordinary WAN traffic, traditional firewall rules may not block it, especially if the destination domains rotate or employ encryption. This makes detection and mitigation exceptionally difficult for organizations lacking advanced network monitoring.

The geopolitical dimension is impossible to ignore. Western governments have long warned about the cybersecurity risks of Chinese networking equipment, citing potential for espionage and sabotage. This year, the U.S. Federal Communications Commission moved to restrict imports of foreign-made routers on national security grounds, a decision that gains fresh urgency from VulnCheck’s findings. While VulnCheck has not publicly attributed the backdoor to a state-sponsored actor, the deliberate inclusion of such a mechanism in mass-market hardware aligns with concerns that Chinese manufacturers could be compelled—directly or indirectly—to embed surveillance capabilities. The discovery adds to a growing body of evidence that low-cost Chinese-made IoT and networking devices frequently harbor undisclosed remote access features.