# ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant CVE record · `CVE-2026-66747` - **Identifiers:** `CVE-2026-66747` - **State:** Confirmed - **Severity:** CVSS 9.3 Critical - **Critical:** Yes: CVSS 9+ - **CNA:** VulnCheck - **Weakness (CWE):** [CWE-506](https://cwe.mitre.org/data/definitions/506.html) - **Tags:** [CWE-506](https://agentprime.io/advisories/tag/cwe-506.md) - **Technologies:** [Zbtlink CPE2801 Firmware](https://agentprime.io/advisories/technology/zbtlink-cpe2801-firmware.md) · [Zbtlink WE1026-5G-WD Firmware](https://agentprime.io/advisories/technology/zbtlink-we1026-5g-wd-firmware.md) · [Zbtlink WE1326 Firmware](https://agentprime.io/advisories/technology/zbtlink-we1326-firmware.md) · [Zbtlink WE2007 Firmware](https://agentprime.io/advisories/technology/zbtlink-we2007-firmware.md) · [Zbtlink WE2008-DSIM Firmware](https://agentprime.io/advisories/technology/zbtlink-we2008-dsim-firmware.md) · [Zbtlink WE2416 Firmware](https://agentprime.io/advisories/technology/zbtlink-we2416-firmware.md) · [Zbtlink WE3326 Firmware](https://agentprime.io/advisories/technology/zbtlink-we3326-firmware.md) · [Zbtlink WE5927 Firmware](https://agentprime.io/advisories/technology/zbtlink-we5927-firmware.md) · [Zbtlink WE5931 Firmware](https://agentprime.io/advisories/technology/zbtlink-we5931-firmware.md) · [Zbtlink WE5931AC Firmware](https://agentprime.io/advisories/technology/zbtlink-we5931ac-firmware.md) · [Zbtlink WE826-T3-DSIM Firmware](https://agentprime.io/advisories/technology/zbtlink-we826-t3-dsim-firmware.md) · [Zbtlink WG108 Firmware](https://agentprime.io/advisories/technology/zbtlink-wg108-firmware.md) · [Zbtlink WG209 Firmware](https://agentprime.io/advisories/technology/zbtlink-wg209-firmware.md) · [Zbtlink WG259 Firmware](https://agentprime.io/advisories/technology/zbtlink-wg259-firmware.md) · [Zbtlink WG1602 Firmware](https://agentprime.io/advisories/technology/zbtlink-wg1602-firmware.md) · [Zbtlink WG1608-DSIM Firmware](https://agentprime.io/advisories/technology/zbtlink-wg1608-dsim-firmware.md) · [Zbtlink WG2105 Firmware](https://agentprime.io/advisories/technology/zbtlink-wg2105-firmware.md) · [Zbtlink WG2107 Firmware](https://agentprime.io/advisories/technology/zbtlink-wg2107-firmware.md) · [Zbtlink WG3526 Firmware](https://agentprime.io/advisories/technology/zbtlink-wg3526-firmware.md) · [Zbtlink ZBT-Z8102AX-2SIM Firmware](https://agentprime.io/advisories/technology/zbtlink-zbt-z8102ax-2sim-firmware.md) - **Published:** 5 Aug 2026 - **Updated:** 5 Aug 2026 - **Reviewed by a person:** No Published by the CVE Program (CNA: VulnCheck) at 5 Aug 2026, 10:50 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. ## Critical Critical, because: - CVSS score 9.3: 9.0 or more. How we decide what’s critical: ## Affected products, as the CNA wrote them - Vendor: Zbtlink. Product: CPE2801 Firmware. - affected: `22.10.09` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WE1026-5G-WD Firmware. - affected: `21.04.07` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WE1326 Firmware. - affected: `22.02.18_1` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WE2007 Firmware. - affected: `23.08.12` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WE2008-DSIM Firmware. - affected: `23.08.11` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WE2416 Firmware. - affected: `21.03.22_1` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WE3326 Firmware. - affected: `20.09.30` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WE5927 Firmware. - affected: `22.08.10` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WE5931 Firmware. - affected: `22.05.31` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WE5931AC Firmware. - affected: `22.05.31` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WE826-T3-DSIM Firmware. - affected: `21.12.21` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WG108 Firmware. - affected: `21.08.06_1` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WG209 Firmware. - affected: `21.07.28` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WG259 Firmware. - affected: `21.03.23` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WG1602 Firmware. - affected: `23.10.11` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WG1608-DSIM Firmware. - affected: `23.03.16` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WG2105 Firmware. - affected: `22.05.30` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WG2107 Firmware. - affected: `22.09.08` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: WG3526 Firmware. - affected: `22.11.01` (custom) - Other versions: unaffected - Vendor: Zbtlink. Product: ZBT-Z8102AX-2SIM Firmware. - affected: `7.6.7.2-25.0814_114432` (custom) - Other versions: unaffected ## Not analysed yet We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter. ## Severity and exploitation - 9.3 Critical, CVSS 4.0: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`, from CNA (VulnCheck) (used for this record) - 9.8 Critical, CVSS 3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, from CNA (VulnCheck) - **CISA KEV:** Not listed. - **EPSS:** 0.0079, the 56th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days. ## Timeline This record came from the full history of the CVE Program, published 5 Aug 2026. New records show when each source confirmed them. ## Sources - [CVE List: CVE-2026-66747](https://www.cve.org/CVERecord?id=CVE-2026-66747) - [NVD: CVE-2026-66747](https://nvd.nist.gov/vuln/detail/CVE-2026-66747) ### References from the CNA - (product) - - (third-party-advisory) - (technical-description, exploit) Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description. ## Check whether this affects you This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run. - With the agentprime MCP server (), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: - As JSON: - Everything that needs attention now: --- The web page: . Everything for agents: .