Much non-CCP-linked tech is insecure for various reasons, many innocent. For example, thanks to the latest advances in artificially intelligent auditing of code, the world must frantically race to repair humongous amounts of rickety legacy code before AI-abetted hackers sabotage it all.
On the other hand, there’s this kind of thing, to which a Fing cybersecurity email briefing alerts us: “A man discovered that the £3 Temu Wi-Fi extender he’d purchased from Temu has a hidden root account, hardcoded password, and remote login enabled by default. The teardown found even more.”
Three British pounds is about four U.S. dollars. Before you buy a four-dollar Wi-Fi extender from Chinese company Temu, follow Fing’s link to CyberNews, which last month reported (September 8, 2026):
While buying a cheap WiFi extender from the site [of online store Temu] might seem like an inexpensive way to banish connectivity dead zones, Keiran Smith’s findings were a little way off receiving a pair of shoes three sizes too small or some pants made of flimsy material….
Smith, known online as Affix, bought a six antenna “WiFi signal/booster/range extender” after it appeared online in an algorithmically targeted Temu ad….
Given that WiFi extenders occupy a sensitive place in people’s homes….Smith decided to crack one open and see what he could find….
Smith found that the extender contains a hidden administrator account with the highest possible privilege. Its password is hardcoded into the firmware, meaning every device running it uses the same one. Crucially, the hidden account is separate from the administrator password that users can change through the extender’s normal settings….
“ ‘Hardcoded password’ covers a wide range of sins,” Smith wrote in his Substack. “This one is a compile-time constant rather than something derived from the MAC address or serial number, so it is identical on every unit ever sold.” Smith also found another surprise running on the device: a remote login service that will accept logins using the hidden root password.
Still more incriminating evidence is detailed. Bottom line: deliberately installed security nightmare. Which company originated the compromise of the tech used in the extender is unclear, however. The MediaTek MT7620, produced by the Taiwanese company, is the installed semiconductor chip; vulnerabilities have been discovered in the bare MT7620 but no malicious surprises like those outlined by CyberNews.
Baby monitors
What Keiran Smith discovered is far from an isolated kind of attack on customers of routers, extenders, and other gadgets with electronic innards.
In May 2026, CyberNews reported that a security researcher found the “mother of all security flaws” in baby monitors “many of which use white-label tech stacks from China and are then rebranded and sold to new parents on channels such as Amazon… White-label manufacturing means parents buying different baby monitor brands on Amazon may actually be purchasing the same Chinese-built system rebranded with different logos.”
The critical flaws the researcher discovered include “unauthorized MQTT data access, exposed device locations, unencrypted snapshots, and hardcoded encryption keys.” (MQTT, Message Queuing Telemetry Transport, is a messaging protocol for Internet of Things devices.)
The compromises of security are described as flaws. But they are not flaws from the perspective of the evildoers responsible for inserting them into various remotely controllable gadgets, either on their own or in cooperation with the Chinese Communist Party.
The vendor in this case is Hangzhou-based Meari Technology. After it took 47 days for the company to even acknowledge the problems, “It remains uncertain whether affected customers were notified or if all devices can receive security updates.”
Also see:
Reuters: “Chinese-made Zbtlink routers have a backdoor, researchers say” (August 5, 2026)
“More than 20 models of a Chinese-made router, available throughout the world, ship with a backdoor that could allow access to and potential connections to other devices on the network, researchers with cybersecurity firm VulnCheck said….
“The backdoor discovered by [Jacob Baines, chief technology officer at VulnCheck] automatically communicates to a specific IP address and a Chinese-registered domain every 35 seconds, he said in a blog post on the company’s website.”
VulnCheck: “ENDLESSDOORS Is Phoning Home. Pick Up.” (August 5, 2026)
“Every firmware on zbtlink.com’s download page, roughly two dozen images, embeds the rctl implant and starts it at boot with an init.d script named skworker. All of them phone home. All of them are hijackable the same way…. There is no fixed firmware. Treat this as a device-trust problem, not a patching problem.”
VulnCheck: “Chinese Implants in the Supply Chain” (August 27, 2026)
“In our previous blog, ‘ENDLESSDOORS Is Phoning Home. Pick up,’ we detailed a phone-home implant vulnerable to man-in-the-middle attacks embedded in ZBT routers. In this blog, we trace the ZBT supply chain. We got more than we bargained for….
“We found two new implants on the device. SPEAKINGSTONE, like ENDLESSDOORS, is a phone-home implant that connects back to ZBT’s cloud infrastructure and accepts remote commands. DARKLANTERN is a backdoor that listens on the WAN and executes arbitrary commands.”
