{"metadata": {"vulnerability": "CVE-2026-66747", "count": 19, "kinds": {"milestone": 4, "sighting": 6, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-07-27T16:27:47.648Z", "date_only": false, "value": "2026-07-27T16:27:47.648Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-66747", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-05T00:00:00Z", "date_only": false, "value": "2026-08-05T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-66747", "field": "containers.cna.datePublic"}, {"timestamp": "2026-08-05T10:34:46.528Z", "date_only": false, "value": "2026-08-05T10:34:46.528224Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/catc0n/statuses/117042451920559868", "record": "CVE-2026-66747", "field": "creation_timestamp", "uuid": "1fbbcd10-334c-475c-8d82-95f936fea9e9", "content": "Today, VulnCheck is disclosing #ENDLESSDOORS, a phone-home implant CTO @albinolobster discovered in Zbtlink routers. ENDLESSDOORS starts automatically, runs with root privileges, and attempts to connect to command-and-control infrastructure roughly every 35 seconds. The backdoor ships by default across 20+ Zbtlink router models, which are white-labeled and sold on popular retail sites including Amazon, AliExpress, and Alibaba.\nThe implant and server implement no encryption or verification, meaning anyone along the network path can hijack the client-server communication and obtain a root shell on the device, regardless of the router's network position. \nThe VulnCheck CNA has assigned CVE-2026-66747 to track backdoored firmware versions; our blog also has guidance for defenders, including affected firmware images, hashes, network indicators, a YARA rule, and network signatures (Suricata / Snort).\nhttps://www.vulncheck.com/blog/zbt-endlessdoors", "url": "https://infosec.exchange/users/catc0n/statuses/117042451920559868"}, {"timestamp": "2026-08-05T10:50:45.576Z", "date_only": false, "value": "2026-08-05T10:50:45.576Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-66747", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-08-05T10:55:20.206Z", "date_only": false, "value": "2026-08-05T10:55:20.206Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-66747", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-05T11:16:25Z", "date_only": false, "value": "2026-08-05T11:16:25Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-GF5Q-Q6H6-J87V", "record": "GHSA-GF5Q-Q6H6-J87V", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-08-05T11:16:25.510Z", "date_only": false, "value": "2026-08-05T11:16:25.510", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-66747", "record": "FKIE_CVE-2026-66747", "field": "published"}, {"timestamp": "2026-08-05T11:30:05.453Z", "date_only": false, "value": "2026-08-05T11:30:05.453959Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msdgfvc7v32b", "record": "CVE-2026-66747", "field": "creation_timestamp", "uuid": "d566dd91-d6d4-43bb-ab87-961f51829cfa", "content": "CVE-2026-66747 - cpe2801 firmware\nThe Zbtlink router has a hidden program that allows an attacker to control the router remotely without a password. This could allow an attacker to make changes to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cpe2801firmware #zbtlink #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3msdgfvc7v32b"}, {"timestamp": "2026-08-05T12:31:30Z", "date_only": false, "value": "2026-08-05T12:31:30Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-GF5Q-Q6H6-J87V", "record": "GHSA-GF5Q-Q6H6-J87V", "field": "published"}, {"timestamp": "2026-08-05T12:31:30Z", "date_only": false, "value": "2026-08-05T12:31:30Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-GF5Q-Q6H6-J87V", "record": "GHSA-GF5Q-Q6H6-J87V", "field": "modified"}, {"timestamp": "2026-08-05T14:19:25.533Z", "date_only": false, "value": "2026-08-05T14:19:25.533200Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-66747", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-05T14:19:25.533Z", "date_only": false, "value": "2026-08-05T14:19:25.533200Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-66747", "record": "FKIE_CVE-2026-66747", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-05T14:20:12.478Z", "date_only": false, "value": "2026-08-05T14:20:12.478Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-66747", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-05T14:20:12.478Z", "date_only": false, "value": "2026-08-05T14:20:12.478Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-66747", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-05T18:04:52.303Z", "date_only": false, "value": "2026-08-05T18:04:52.303302Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/hugovalters/statuses/117044221640947736", "record": "CVE-2026-66747", "field": "creation_timestamp", "uuid": "e2fa9239-3833-46a9-bf35-81606baea952", "content": "CVE-2026-66747 - Critical RCE via hidden ENDLESSDOORS implant in Zbtlink routers. Backdoor runs as root, phones home over cleartext. CVSS 9.8. Unpatched. Isolate devices now. #CVE #infosec #IoT\nhttps://www.valtersit.com/cve/CVE-2026-66747/", "url": "https://mastodon.social/users/hugovalters/statuses/117044221640947736"}, {"timestamp": "2026-08-07T02:30:34.605Z", "date_only": false, "value": "2026-08-07T02:30:34.605012Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mshj6yyyyy27", "record": "CVE-2026-66747", "field": "creation_timestamp", "uuid": "8988671d-face-4b41-9621-0a745a4e5412", "content": "CVE-2026-66747: a Zbtlink router backdoor named ENDLESSDOORS gives unauthenticated remote code execution as root. No fix exists. CVSS 9.8.\n\n#Zbtlink #RouterBackdoor #CVE #IoT #CyberSecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mshj6yyyyy27"}, {"timestamp": "2026-08-22T08:00:03.942Z", "date_only": false, "value": "2026-08-22T08:00:03.942190Z", "kind": "sighting", "label": "Seen", "source": "Telegram/STxGsrhQP6hZxkehr2eSvviXIon440Ogfxey7gY5WpdfDHc", "record": "CVE-2026-66747", "field": "creation_timestamp", "uuid": "5a4d4b98-9115-44cc-b672-447effbaf038"}, {"timestamp": "2026-08-23T00:00:40.804Z", "date_only": false, "value": "2026-08-23T00:00:40.804088Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/STxGsrhQP6hZxkehr2eSvviXIon440Ogfxey7gY5WpdfDHc", "record": "CVE-2026-66747", "field": "creation_timestamp", "uuid": "6507c8e6-35a3-4d91-b0a2-ed0e8e06baed"}, {"timestamp": "2026-09-09T20:35:08.537Z", "date_only": false, "value": "2026-09-09T20:35:08.537", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-66747", "record": "FKIE_CVE-2026-66747", "field": "lastModified"}]}