OIEH Router Checker

A Windows program that checks with a single click whether your router is affected by the Chinese backdoor (ENDLESSDOORS)

No installation required · No administrator rights required · No external data transmission

What Is This?

In August 2026, security firm VulnCheck discovered a remote-control backdoor in the official firmware of 20 router models from China's Zbtlink (Shenzhen Zbtong Electronics) / Wiflyer and its OEM (rebranded) counterparts.

• Name: ENDLESSDOORS · CVE ID: CVE-2026-66747 (severity 9.3/10)
• Behavior: Runs automatically when the router is powered on, sends a beacon to servers in China about every 35 seconds, and executes remote commands with administrator (root) privileges without any authentication.
• The scary part: It cannot be removed by a factory reset (it is baked into the firmware). Turning off remote management or UPnP doesn't block it either (because the router calls out to the outside first).

This program lets even beginners safely run a first-pass screening to check whether their router is a target of this campaign.

If you are using a router provided by your ISP (KT/SKB/LGU+) or an ipTIME router, this campaign mostly does not apply to you. If you have an unfamiliar 4G/5G or mini router bought directly from AliExpress/Amazon, it is worth checking.

⚠️ Limitations to Know First (Important)

This program is a first-pass risk assessment (triage), not a tool for making a definitive determination.

The backdoor's 35-second beacon is a signal the router itself makes to the outside (WAN), so it is fundamentally unobservable from an ordinary PC connected behind the router (since it is behind NAT). Therefore, this program combines what can be discovered from the PC without installing anything — manufacturer (MAC), ports, DNS, model, etc. — and renders a traffic-light verdict.

• 🟢 Safe = Confirmed as a manufacturer unrelated to this Zbtlink campaign (this does not mean it is safe from all other security threats)
• 🟡 Caution = Manufacturer could not be identified or suspicious signals found → label entry / advanced inspection recommended
• 🔴 Danger = Determined to be a device targeted by this backdoor

If you want a definitive inspection, follow the Wireshark interception guide generated by the [Open Advanced Inspection Guide] button in the program (a method of connecting a laptop in front of the router's WAN side to directly capture the 35-second beacon).

How to Use (For Beginners, 30 Seconds)

1. Download from this repository via Code ▸ Download ZIP and extract it. (or git clone)
2. Double-click OIEH Router Checker.bat in the extracted folder.
3. When the window opens, press the [Start My Router Check] button. (Takes a few dozen seconds.)
4. Check the result with the traffic-light color and message at the top.
   • Entering the model name / FCC ID printed on the router label into the input field makes it more accurate (optional).
5. If needed, use [Save Result] (a txt file — good for sending to someone you know to review) and [Open Advanced Inspection Guide].

If a "Windows protected your PC" warning appears when running, click More info ▸ Run anyway. (This is a common warning that appears because it is an unsigned personal script.)

If It Won't Run (Troubleshooting)

This program requires nothing to be installed — it only uses components built into Windows 10/11. If it doesn't run, it is usually one of the following.

1. Running without extracting the ZIP — the most common cause. Right-click the ZIP file → [Extract All], then run OIEH Router Checker.bat from inside the extracted folder. Double-clicking it directly inside the ZIP or copying only the bat file will not work. (In this case, the program shows an explanatory popup.)
2. You dismissed the SmartScreen warning — On the blue "Windows protected your PC" screen, you must click More info ▸ Run anyway.
3. Other errors — The error is shown in a popup and in the black window, and detailed logs are kept in the %TEMP%\OiehRouterChecker.log file. If you can't resolve it, capture the contents and report it via the link below.

Report issues: https://itoieh.blogspot.com/2026/08/oieh-router-checker.html (comments)

What Does It Check?

Verdict principle: if the manufacturer cannot be confirmed, it never gives 🟢 (Safe).

🔴 If the Result Is Dangerous

1. Disconnect this router from the network. (The backdoor cannot be removed by a factory reset or by changing settings.)
2. Plan to replace it with a different, safe router.
3. If you have used that router for a long time, change all account passwords used on that network (especially NAS, admin, and reused passwords).

Affected Models in This Campaign (Zbtlink/Wiflyer, OEM May Be Included)

CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326,
WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG209, WG259, WG1602,
WG1608-DSIM, WG2105, WG2107, WG3526, ZBT-Z8102AX-2SIM

Zbtlink openly offers OEM/ODM (rebranding). The same firmware may be present in identical hardware sold under a different brand label, so don't trust the label alone. If the FCC ID prefix (grantee code) is 2AH9T or 2AC47, the original manufacturer is Zbtlink.

Privacy · Security

• This program does not transmit any of your data over the internet. All checks are performed only locally (my PC ↔ my router).
• No administrator rights are required, and it does not alter router firmware.
• The scan target must be your own network/equipment.

Requirements

• Windows 10 / 11 (uses the built-in Windows PowerShell 5.1)
• No separate installation needed (no nmap, Python, etc.)

Developer Documentation

Structure

OIEH Router Checker.bat        Entry point (double-click) → launches PowerShell
OiehRouterChecker.ps1          Network probe (fact collection) + WinForms GUI
OiehRouterChecker.Core.psm1    Pure verdict logic (OUI/ports/DNS/verdict/report) — test target
data/ioc.json                  Scan data (affected list · OUI · port policy · trusted DNS)
templates/advanced-guide.html  Advanced inspection (Wireshark) guide template
tests/OiehRouterChecker.Tests.ps1  Pester tests (51)

The code that touches the network (.ps1) and the code that makes decisions (.Core.psm1) are separated. Core consists of pure functions from "collected facts → verdict", so it is fully tested without a network.

Running Tests

Install-Module Pester -MinimumVersion 5.0 -Scope CurrentUser -Force   # first time only
Invoke-Pester -Path tests\OiehRouterChecker.Tests.ps1 -Output Detailed

Updating Scan Data

When new affected models or OEMs become known, just update data/ioc.json without any code changes (affected.models, affected.ouis, affected.fcc_grantee_codes, etc.). Information that is not public (C2 domains/IPs, etc.) is left empty rather than filled in by guesswork, and the verdict is handled in the safe direction (🟡).

Disclaimer

This program is an unofficial community tool and is not affiliated with VulnCheck or the original security research organizations. 🟢 (Safe) means "not a target of this ENDLESSDOORS/Zbtlink campaign" and does not guarantee the complete security of the device. A definitive verdict is only possible through advanced inspection (WAN-side interception). The user assumes responsibility for its use.

License

MIT

Sources

• VulnCheck — ENDLESSDOORS Advisory
• VulnCheck — "ENDLESSDOORS Is Phoning Home. Pick Up."
• MAC OUI: IEEE Registration Authority / Wireshark manuf · FCC ID: fccid.io