A 3-Pound Wi-Fi Repeater Backdoor Threatens Network Security
A Wi-Fi repeater costing a mere 3 pounds has emerged as a device harboring a pre-configured, concealed backdoor, effectively inviting complete system compromise. Penetration tester Kieran Smith meticulously dissected the firmware of an unbranded signal amplifier procured from Temu, uncovering an undocumented root account possessing a universal password across the entire product line. Merely altering the standard administrative password fails to rectify this vulnerability, as the repeater perpetually restores these clandestine credentials upon every reboot.
Unveiling the Hidden Root Credentials
Vendors marketed the apparatus as a six-antenna signal booster, devoid of any discernible model or manufacturer identity. Upon dismantling the device, Smith identified a Z05L V1.0 motherboard, a MediaTek MT7620 processor, and a 4-megabyte Winbond W25Q32BV SPI flash memory chip. Curiously, of the six advertised antennas, a mere four were actually connected to the circuitry. The firmware operates on Linux 2.6.36 and Buildroot 2012.11.1; remarkably, while the build date indicates August 2024, official support for the Linux 2.6.36 kernel ceased entirely in 2011.
Utilizing a Bus Pirate tool, the researcher extracted the flash memory contents, decompressed the kernel, and retrieved the embedded initramfs file system. Within a proprietary utility dubbed masterCtrl, he discovered a nine-character string that the execution code automatically designates as the root password upon initialization. This account acquires UID 0, thereby granting it supreme administrative privileges within the Linux environment.
Simultaneously, during each startup sequence, masterCtrl unconditionally launches a Telnet service. This service leverages system authentication and readily accepts the concealed root password. The web interface utterly fails to display this clandestine account, denying the owner any ability to revoke access or permanently alter the password. Even executing a manual password change via the system console proves futile beyond the current power cycle. Because the root file system operates entirely within volatile memory, masterCtrl simply regenerates the credentials from a hardcoded constant upon the subsequent boot.
Severe Authorization and API Vulnerabilities
The predicament extends far beyond a hidden password. Comprehensive analysis revealed that the repeater web API practically bypasses authorization checks prior to executing administrative actions. While the login page generates a browser cookie indicating successful authentication, the backend architecture completely neglects robust session management, failing to mandate verification before processing requests. Consequently, a meticulously crafted API query can effortlessly expose the saved WPA2 key without ever accessing the control panel.
Furthermore, the firmware harbors a critical command injection flaw. A specific handler inserts a submitted MAC address directly into a system command string, utterly lacking proper sanitization. Through this vulnerable query, an attacker situated within an accessible network can execute arbitrary commands with absolute root authority. Although the codebase actually contains a dedicated function for validating MAC addresses, the flawed handler tragically neglects to invoke it. For further technical details, one can review the comprehensive analysis regarding the 3-pound Wi-Fi extender with a backdoor.
Expanding the Attack Surface
Establishing persistence following a successful breach is comparably trivial. The repeater validates firmware updates relying solely upon CRC32 checksums and image size parameters. The researcher found absolutely no evidence of cryptographic signatures, HMAC verification, or manufacturer keys. While CRC32 successfully identifies accidental file corruption, it completely fails to authenticate the firmware origin. Therefore, a malicious actor can craft a formally valid, tampered image, ensuring that their nefarious modifications survive subsequent reboots.
Insecure network configurations dramatically expand the attack surface. Although masterCtrl utilizes iptables rules for NAT and routine packet processing, the INPUT filter table inexplicably retains an ACCEPT policy. Consequently, Telnet, HTTP, and various other listening services remain universally accessible across the repeater interfaces, including its upstream WISP connection. Within a hotel, cafe, dormitory, or any shared network environment, virtually any participant on that subnet can potentially access the concealed root account.
Ascertaining the precise brand of the finished product proved impossible. The Z05L motherboard conforms to a white-label manufacturing scheme, wherein a singular baseline design is distributed across numerous vendors under wildly varying nomenclatures. This reality renders the true scale of the vulnerability exceedingly difficult to quantify, as identical firmware and the universal secret password may afflict visually distinct repeaters. Moreover, the investigation does not conclusively prove malicious intent on behalf of the developers. This covert access may simply be an egregious remnant of factory diagnostics or technical support protocols. Nevertheless, for the end-user, the practical consequence remains unaltered: the device harbors an undocumented root portal that cannot be legitimately disabled or permanently modified.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
