VULNCHECK reported critical vulnerabilities in ZBT routers, specifically the backdoors known as DARKLANTERN and SPEAKINGSTONE, rated with a CVSS score of 9.3. These backdoors allow unauthorized root access via the internet, affecting devices sold globally. The vulnerabilities are labeled as CVE-2026-74232 and CVE-2026-74233, which exploit insecure UDP ports to gain control over the devices. The report indicates a significant supply chain risk, with live deployments confirmed in over 20 countries.
No vendor fixes are available, and guidelines recommend removing affected devices from sensitive networks and blocking specific inbound connections.