The two implants, dubbed SPEAKINGSTONE and DARKLANTERN, are being tracked as CVE-2026-74232 and CVE-2026-74233, respectively. These are not post-exploitation backdoors added after the fact; they are present in the factory firmware itself, meaning devices ship with the vulnerabilities already in place.

The implications are significant for any organization using ZBT hardware in their network infrastructure:

• Both implants allow remote code execution with root privileges, bypassing authentication entirely.
• Because the flaws are embedded in the firmware at the manufacturing stage, standard patching or reimaging may not remove them unless a vendor-supplied update specifically addresses the issue.
• Attackers exploiting these flaws would gain full control over the router, enabling traffic interception, persistent access, or use of the device as a pivot point into the broader network.

At the time of writing, no vendor response or patching timeline has been mentioned in the report. Organizations using ZBT routers should treat them as untrusted and consider isolating them from sensitive network segments until a fix is confirmed.

Source: The Hacker News

Is your organization currently running any ZBT-based hardware, and if so, what steps are you taking to mitigate exposure while awaiting an official fix?