Chinese-made routers, sold on Amazon and eBay, contain hidden backdoor and are being exploited by Mirai malware and other methods

CyberNews.com’s Investigations team today announced that they have identified hidden backdoors in Chinese-manufactured routers that share common firmware, with evidence that the routers are being exploited by the Mirai malware. In a collaboration between CyberNews.com Senior Information Security Researcher Mantas Sasnauskas and researchers James Clee and Roni Carta, the team found that routers sold by Amazon, eBay and Walmart are all affected, and vulnerabilities are already being exploited.

The two brands identified are, Wavlink routers that are available on eBay and also highlighted as an Amazon Choice Router, and Jetstream routers which are sold exclusively at Walmart. 

These critical vulnerabilities allow attackers to remotely control the routers as well as any device connected to that network and monitor all the traffic coming through that router. It's akin to constant surveillance on your personal network, with someone watching all your activity and stealing all your information. Additionally, the Wavlink routers contain a script that lists nearby wifi and has the capability to compromise those networks.

CyberNews has already detected multiple malicious attempts from a Chinese IP address, which is trying to upload and execute a harmful script on the routers. After investigating the suspicious file, the investigation team has identified that is part of the infamous Mirai botnet.

The Mirai botnet has been responsible for multiple major attacks, including a large-scale DDoS attack in 2016 that left much of the internet inaccessible on the US East coast.

“After my initial findings on the first router I purchased, I bought two more repeaters off Amazon,” said Clee. “Although they are very different physically and slightly different technically, all three had almost the exact same exploit chain. It's hard to make sweeping, definitive statements, but given that all three had the same flaws I’d suspect that many more Wavlink devices are the same.”

When CyberNews.com attempted to find information on the companies behind these routers, it appears that both Jetstream and Wavlink are subsidiaries of a Shenzhen-based company known as Winstars Technology Ltd, which reportedly exports 1-2M pieces per month.

To date, none of the retailers or manufacturers involved have responded to the findings.

Researchers Clee and Carta are in agreement that the backdoors found are intentional. “This is not a mistake,” Carta asserts. “Someone had to take the decision to make the password client-side. A human conceived this code knowing that this would be accessible from an unauthenticated user. Now, the question is why?”

“The fact that there’s a GUI for RCE, and the fact that a page was established to validate a password outside of the existing authentication mechanisms, leads me to believe that neither were an accident, Clee said.”

Mantas Sasnauskas, a Senior Researcher on CyberNews.com’s Investigations team, said “We are working hard to see if we can identify any active exploitation, as the investigation has revealed the vulnerabilities of these routers are being exploited by the Mirai malware. Such vulnerabilities in Chinese hardware or software can’t be discussed without acknowledging the Chinese government’s position on national and international surveillance.

Chinese data retention laws force Chinese companies, or companies operating in China, to keep data on servers located inside the country – and to provide practically unrestricted access to that data to law enforcement. This includes even encrypted data, with the Chinese government requiring access to decryption keys.” He continued, “This type of undocumented backdoor access is a major reason that the United States, Germany, and other governments around the world banned Huawei when they found that the Chinese company could secretly access sensitive information for devices that it sold.”

Existing customers are advised to stop using Jetstream and Wavlink routers, temporarily shut down the network, clean computers, and reset computer passwords and logins for online accounts to protect themselves, their families and their neighbors.

Featured

  • Pragmatism, Productivity, and the Push for Accountability in 2025-2026

    Every year, the security industry debates whether artificial intelligence is a disruption, an enabler, or a distraction. By 2025, that conversation matured, where AI became a working dimension in physical identity and access management (PIAM) programs. Observations from 2025 highlight this turning point in AI’s role in access control and define how security leaders are being distinguished based on how they apply it. Read Now

  • Report: Cyber Attackers Continue to Turn to AI-Based Tools to Avoid Detection

    Comcast Business recently released its 2025 Cybersecurity Threat Report, a comprehensive analysis of 34.6 billion cybersecurity events detected between June 1,2024 and May 31, 2025. Now in its third year, the report offers business leaders a unique perspective into the evolving threat landscape and provides actionable insights to help organizations strengthen their defenses and align cybersecurity with business risk. Read Now

  • Axis Communications Creates AI-powered Video Surveillance Orchestra

    What if cameras could not only see the world, but interpret it—and respond like orchestra musicians reading sheet music: instantly, precisely, and in perfect harmony? That’s what global network technology leader Axis Communications set to find out. Read Now

  • Just as Expected

    GSX produced a wonderful tradeshow earlier this week. Monday was surprisingly strong in the morning, and the afternoon wasn’t bad at all. That’s Monday’s results and asking attendees to travel on Sunday. Just a quick hint, no one wants to give up their weekend to travel and set up an exhibit booth. I’m just saying. Read Now

    • Industry Events
    • GSX
  • NOLA: The Crescent City

    Twenty years later we finds ourselves in New Orleans. Twenty years ago the aftermath of Hurricane Katrina forced exhibitors and attendees to look elsewhere for tradeshow floor space. Read Now

    • Industry Events
    • GSX

New Products

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.