The most blatant security backdoor yet seen in an internet router has been found in a range of models sold under multiple brand names. A firmware implant phones home to cloud servers in China to ask for instructions, and can then be remotely controlled …

Earlier this year, the US government banned the import and sale of all new models of Chinese routers, citing national security risks. It followed the discovery last year that thousands of Asus routers had been compromised by a botnet, with devices from Cisco, D-Link and Linksys also targeted.

A major challenge to avoiding these kinds of embedded malware threats is that so many Chinese-made routers are sold under different brands, sometimes with different claimed countries of origin. Additionally, many are rebadged and supplied as standard by US ISPs, so customers have literally no idea who made their router.

Cybersecurity company VulnCheck has now found an incredible and deliberate backdoor built into routers made by Shenzhen Zhibotong Electronics and sold under a variety of brands that include Zbtlink and Wiflyer. They dubbed it ENDLESSDOORS as it can be exploited in endless ways.

They are an implant, a phone-home trojan horse. Our zero-day research team named this ENDLESSDOORS. This, at its core, is a small tool called rctl (remote control linux). Uploaded to GitHub on January 14, 2015 and never touched again, this obscure repository implements a simple command and control client and server. The server listens on port 7000 for clients to connect. It can send the client individual shell commands or tell the client to spawn a reverse bash shell.

The researchers say that it poses the biggest risk yet seen because it initiates the contact with its command and control servers.

Because the device dials out, none of this requires the router to be reachable from the internet. There’s no listening port to find and no inbound rule to punch through. The connection originates inside the network and traverses NAT and typical egress filtering the way any outbound TCP session does. A unit sitting behind three layers of firewall in a hotel back office is exactly as reachable as one with a public IP, provided it can get to the [command server].

How to check your router

VulnCheck says you should ignore whatever branding your router may have and check for one of the affected model numbers:

CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, Z8102AX-2DSIM

If your router is one of these, you should immediately disconnect and replace it.