Breaking Legacy Routers: 5 Zero-Days via Reversing and Hardware Hacking

Breaking Legacy Routers: 5 Zero-Days via Reversing and Hardware Hacking

Speakers: Danilo Erazo, Independent Security Researcher

Conference: REcon 2025

YouTube: https://www.youtube.com/watch?v=X8b-zDs0qHw

Overview

End-of-life does not mean end-of-risk. In this talk, independent security researcher Danilo Erazo presents five previously undisclosed zero-day vulnerabilities discovered in legacy fiber optic (ONT) routers that remain deployed across thousands of networks, primarily in South America. The research combines hands-on hardware hacking — including UART exploitation and chip-level firmware extraction — with binary reverse engineering of the obscure ARCompact architecture, a processor architecture that most researchers have never encountered.

Four of the five zero-days were discovered by interacting directly with the hardware through UART pins and by extracting firmware from onboard flash memory. The fifth required deep reverse engineering of ARCompact binaries using tools like IDA Pro, Binary Ninja, and a custom Ghidra fork. Taken together, the vulnerabilities form a complete unauthenticated remote code execution chain that also exposes Wi-Fi credentials in plaintext.

The talk is both a technical deep dive and a disclosure story — the vendor confirmed these routers will continue to receive support until 2027–2028 despite initially refusing to patch. Erazo's persistence ultimately prompted the vendor to commit to a firmware update, but at the time of the talk, deployment remained in progress.

Background

▶ Watch: Introduction: 5 zero-days in end-of-life ONT fiber optic routers (0:18)

The target devices are ONT (Optical Network Terminal) routers — the equipment that sits at the customer premises to terminate a fiber optic connection from an ISP. These routers combine two separate chips: a Broadcom ONT SoC (BCM68380) handling the main networking stack and a Quantenna baseband processor (QTT3A40BC) handling the Wi-Fi radio. This dual-SoC design is a key architectural detail that shapes the entire attack surface.

Despite being labeled end-of-life and no longer sold in the US or Canada, these devices are still widely deployed in other regions. The researcher was motivated by the fact that end-of-life products often represent a permanent, unpatched attack surface — particularly for populations that rely on ISP-provided infrastructure without any expectation of regular security updates.

The hardware hacking angle is significant: much of the embedded security research community focuses on extracting firmware from flash and then doing purely offline analysis. Erazo's work demonstrates a more complete approach, combining physical UART access with binary analysis of non-standard architectures.

Key Findings

▶ Watch: Firmware extraction from NAND flash memory (3:57)

1. Root Access via UART to the Broadcom SoC

The primary UART interface for the Broadcom SoC was identified on the board. Standard tools — Bus Pirate and Tigard — both failed to produce legible output due to framing issues and buffer limitations. Erazo's solution was to transmit data using the Bus Pirate while capturing the output with a logic analyzer, then parsing it with a custom Python script. After switching to an FTDI FT232RL-based interface (which provides better baud rate accuracy, real-time timing, and higher-speed UART logging), he obtained a full root shell. Root access required no password.

2. Hidden Interface with Unauthenticated Root Tunnel Access

During analysis of the boot process, Erazo observed a ping to the link-local IP range (169.254.x.x) — a behavior that occurs when DHCP is unavailable. Scanning this hidden link-local interface revealed TCP port 23 (Telnet) open with no authentication required. Connecting to this service immediately provided root access to the Quantenna (container) SoC, including the ability to read /etc/shadow (which contained empty password fields), Wi-Fi pre-shared keys, and SSID configuration — all in plaintext.

3. SPI Flash Containing Hardcoded Credentials

Firmware extracted from the NAND TSOP-48 flash (using a compatible flash programmer) and from the SPI flash revealed hardcoded credentials. The admin panel at the hidden link-local web interface used default credentials: the super-user password was super and the admin password was admin. The SPI flash also stored the Wi-Fi pre-shared key in plaintext. These defaults are consistent across all routers in the product line.

4. Unauthenticated Remote Command Execution via ARCompact Binary

The web server binary (minihttpd) and the PHP CGI processor were both compiled for the ARCompact architecture. After reverse engineering these binaries using a Ghidra fork with ARCompact support, Erazo identified a PHP file (tools_command.php) containing a direct call to PHP's shell_exec() on unsanitized user input from the text_command parameter. The result of the command execution was printed back to the user via echo. Combined with the hardcoded default credentials discovered in vulnerability #3, this authenticated RCE became an unauthenticated RCE.

5. Lateral Movement to Container SoC and Full Post-Exploitation

By chaining the above vulnerabilities — gaining root on the Broadcom SoC first, then pivoting via the hidden link-local interface to the Quantenna (container) SoC — a complete post-exploitation chain was demonstrated. This included modifying iptables rules, enabling backdoor ports, extracting Wi-Fi credentials from hostapd configuration files, and achieving persistent root access across both system-on-chips.

Technical Deep Dive

▶ Watch: Hidden web interface discovered — CGI attack surface identified (13:06)

Hardware Reconnaissance

The board exposes two distinct UART interfaces: one for the Broadcom SoC and one for the Quantenna SoC. Flash storage consists of a NAND TSOP-48 flash and a SPI flash. Firmware extraction from the NAND required physical removal of the chip and use of a compatible programmer. During this process, a single pin broke — Erazo consulted the datasheet to understand the NAND's internal structure (row/column addressing, I/O ports, control logic) and confirmed the pin was part of the power-on logic for read/write cycles, not the memory array itself, allowing the extraction to proceed.

The extracted NAND binary did not contain the Broadcom kernel firmware; instead it held initialized configuration data, hardcoded constants (IP addresses, ONT module IDs, gateway SLIC information for the LE954 chip), and bootloader initialization code. The actual operating system was stored separately.

The container (Quantenna SoC) firmware was extracted using a separate tool and contained a JFFS2 filesystem, a format commonly found on CCTV and router flash storage.

UART Exploitation and the FTDI Solution

The root cause of Bus Pirate and Tigard failures was a combination of baud rate mismatch, incorrect framing, and buffer performance. By using the FTDI FT232RL chip — which offers real-time hardware timing and high-speed UART logging — Erazo was able to correctly parse the serial stream. Commands executed over this interface (cat /etc/passwd, ifconfig, id) confirmed immediate root access without any authentication prompt.

ARCompact Reverse Engineering

ARCompact is a 16/32-bit mixed-instruction-length RISC architecture developed by Synopsys and used in embedded SoCs. It features 32 general-purpose registers plus dedicated loop registers (LP_START, LP_END, LP_COUNT). Available tooling:

• IDA Pro — built-in ARCompact support, but commercial
• Binary Ninja — community plugin for ARCompact
• Ghidra fork — an open-source fork with ARCompact support, buildable on Windows, Linux, and macOS

Erazo used the Ghidra fork as the primary tool. Analysis of minihttpd revealed version 1.19 of the ARC Labs variant. Analysis of the PHP CGI binary showed heavy use of command strings and direct shell_exec() calls, pointing toward command injection as the likely vulnerability class. The server-side CGI architecture meant that the web server itself was a thin proxy; all business logic and vulnerabilities resided in the PHP files it dispatched to.

Exploit Chain

The full unauthenticated RCE chain:

1. Access the hidden link-local interface (detected at 169.254.101.x) — no authentication required
2. Authenticate to the web admin panel using hardcoded defaults (super/super or admin/admin)
3. Invoke the RCE endpoint in tools_command.php by passing a shell command in the text_command parameter
4. Use the resulting root shell to open a backdoor port (e.g., 4444) via iptables
5. Use Netcat to connect to the backdoor and operate as root
6. Extract the Wi-Fi SSID and passphrase from hostapd.conf

Demo / Proof of Concept

▶ Watch: Zero-day #2: hardcoded default admin credentials in firmware (18:44)

Erazo demonstrated a live exploit chain during the talk. The demo showed:

• Port 4444 initially closed on the hidden interface
• Exploit execution via the tools_command.php RCE endpoint
• Port 4444 opening in real time
• A Netcat connection returning a root shell (id output confirming uid=0)
• Extraction of the Wi-Fi SSID and WPA pre-shared key in plaintext from hostapd configuration

An automated exploit script was developed and kept private in Erazo's GitHub repository. The demo confirmed that an attacker on the same link-local network segment (or with access to the first SoC via UART) could achieve full root access to the Quantenna SoC and extract all sensitive configuration data.

Defensive Implications

▶ Watch: Live exploit demo: reverse shell via injection chain (19:26)

For end users: These routers should be replaced or isolated from any network segment where they could be reached. The hidden link-local interface and its unauthenticated Telnet service represent an attack vector that cannot be mitigated without a firmware patch.

For ISPs deploying these devices: Segment ONT management interfaces on VLANs not accessible to subscriber-side traffic. Audit deployed configurations for default credentials, particularly the super/super and admin/admin defaults that are hardcoded into the product line.

For the vendor: As of the talk, a firmware patch was committed to after sustained pressure from the researcher. The patch should address:

• Password enforcement on the Telnet service at the link-local interface
• Input validation (or outright removal) of the shell_exec() call in tools_command.php
• Removal of hardcoded default credentials from SPI flash storage
• Encryption or removal of plaintext Wi-Fi PSK storage in flash

Disclosure timeline: Initial vendor contact in February 2025 resulted in a response that the router line was end-of-life and would not be patched. After repeated escalation, the vendor reversed course in May 2025 and committed to releasing a firmware update. CVEs were not yet assigned at the time of the talk, as the vulnerabilities had not been registered in the MITRE database.

Key Takeaways

• Dual-SoC designs double the attack surface. The Broadcom and Quantenna SoCs expose independent UART interfaces and network services; compromise of one enables lateral movement to the other.
• End-of-life does not mean patched. These routers remain deployed across thousands of networks with no update infrastructure, making zero-days effectively permanent until devices are physically replaced.
• UART tool choice matters. The Bus Pirate and Tigard both failed due to timing and buffering limitations; the FTDI FT232RL resolved these issues and delivered reliable UART communication.
• ARCompact is a real attack surface. Embedded SoCs using ARCompact are generally underexplored. Open-source tooling (the Ghidra fork) makes analysis feasible without a commercial IDA license.
• Sustained disclosure pressure works. The vendor initially refused to patch citing end-of-life status. After multiple escalations — including conference acceptance as leverage — a firmware update was committed.

About the Speaker

Danilo Erazo is an independent security researcher and bug hunter based in Ecuador. His primary research interests span embedded device security, car hacking, and binary reverse engineering. He maintains a YouTube channel documenting his research and organizes a security event called Pangola in Ecuador. He has presented at the Hacker Manifest conference in Brazil and at REcon 2025, where this talk marked his first REcon appearance.