The hijack needs no vulnerability. It needs a device that accepts a command from the network and cannot check who sent it. VulnCheck says SPEAKINGSTONE's beacon is cleartext UDP to a hard-coded cloud C2, with no authentication and no transport encryption [4]. There is no handshake or credential in that path to defeat, so a reply that arrives and parses is a command [2]. VulnCheck's own framing is blunter than mine: anyone who occupies the C2 position obtains root command execution on the device, regardless of who planted the implant [5]. The team also shipped the exploit that takes that position, along with a version scanner, PCAP, a Nuclei template, and Snort, Suricata and YARA rules [6].
Read the two disclosures together and the firmware is the finding. SPEAKINGSTONE runs as root inside MoreQuick's MQWrt image on ZBT routers [2], and DARKLANTERN is an unauthenticated remote root command injection in infosrvd, which VulnCheck describes as a MoreQuick "revProto" backdoor daemon shipped in the same image [7]. One path is inbound and one is outbound, and both end at root [1]. A daemon called infosrvd is at least named well enough to survive a review checklist.
The outbound design is what breaks your inventory. SPEAKINGSTONE opens no listening port [3], so an outside-in port sweep of the WAN address returns nothing useful, and detection has to come from firmware version checks or from watching egress [3]. That is the one piece of good news in the disclosure: a cleartext UDP beacon to a fixed endpoint is among the easier things to spot on a network you control, and VulnCheck published the capture and the IDS rules to spot it with [6].
Now the number. VulnCheck Target Intelligence put DARKLANTERN in 22 countries, with the largest share in the United States [8]. That figure reflects what their scanning can reach, and it likely understates the real total: a unit whose infosrvd answers only on the LAN side would not show up in an internet-side count at all [5]. The granularity gap in the same bulletin is instructive. For Zimbra it gives roughly 6,900 exposed instances and for GeoServer roughly 1,100 [11], but for the router implants it gives a country list and no device total [4]. Plan on your own fleet count being unknown.
Which leaves the awkward part of remediation. The daemon is part of the vendor image rather than a third-party component you can patch out, so getting rid of it depends on MoreQuick or the brand owner shipping a build without it, or on replacing the firmware or the hardware [6]. And the brand is not the unit you can search on, because VulnCheck names white-label MediaTek units, "Deep Orange" among them, carrying the same MQWrt firmware [7]. Identification runs on the firmware string, not the label on the case.
