Hardware Hacking: From zero to a Pre-Auth Stack Buffer Overflow on Amazon's best-selling router Contents Hardware Hacking: From zero to a Pre-Auth Stack Buffer Overflow on Amazon's best-selling router This will be a blog series where we’ll do a deep dive into the Mercusys MB115-4G router, which, as of today (02/17/2026), is the best-selling router on Amazon Spain. In this first post, we’ll cover the workflow from receiving the device to gaining a root shell via UART and extracting the firmware. In the upcoming posts, we’ll analyze the firmware searching for vulnerabilities. UPDATE - 04/08/2026 Or at least that was the idea. I did find vulnerabilities, but I kept putting off writing up the discovery because I had started investigating other things (mainly the Windows kernel) and ended up forgetting about it. I’ve now added a section at the end explaining the bug I found, now that it’s patched and the 90-day responsible disclosure period has ended :) 1. Some prior reconnaissance While I was waiting for the router to arrive, I decided to gather as much information as I could, both for the hardware and the firmware. As for the first, I started looking for the FCC ID, hoping to find some juicy information about the internals of the device and their datasheets. Unfortunately for me, the device wasn’t indexed in the FCC ID database, meaning that this router doesn’t have an FCC certificate and its use and distribution is illegal in the US. I kept looking for some internal images on other sites like WikiDevi or OpenWrt, but I couldn’t find anything, so I decided to wait for the device to arrive to discover it myself. Regarding the firmware, I found 2 versions on their support page. These were kind of weird, because there is no indication of which one is the latest version—the dates said one thing but the numbers in the firmware names indicated the other. I decided to download both and compare them. Figure 1: Firmware versions available in the downloads section After extracting the SquashFS filesystem with binwalk (I also took a brief look at the kernel and the U-Boot bootloader, but they weren’t my main interest) and comparing both versions with diffing tools (meld and diff), I found that the differences between versions were minimal—only a couple of additions in the web page information to identify and support other router models. As they were the same, I went with version 1.6.0. The first thing I did was to look for the init process (the first userland process that is loaded after the kernel). I found this in /etc/inittab : Figure 2: Contents of the inittab file First line indicates that the first thing the system will do on boot is execute the /etc/init.d/rcS script (we’ll go to that in a second) The second line gives us some interesting info. We have a serial interface ttyS1 in the second serial port of the CPU (first is ttyS0). It has a baud rate of 115200 (pretty standard speed). This will come in handy when we have the physical device to connect to it via UART. Now, looking at the rcS script we also see some interesting information, I share the most interesting findings here: A comment suggesting that the device uses the MediaTek MT7628 (standard in this price range) 1 # 7628 watch dog Some security-related info: 1 2 3 4 5 6 7 8 9 10 /bin/mkdir -m 0777 -p /var/https /bin/mkdir -m 0777 -p /var/lock /bin/mkdir -m 0777 -p /var/log [ ...] cp -p /etc/passwd.bak /var/passwd [ ...] telnetd [ ...] Max perms for everyone in a lot of /var directories Telnet without args (open console for anyone?) The system seems to be restoring the same passwords file at every boot. Let’s have a look at the passwd.bak file: Figure 3: Contents of the passwd.bak file dropbear : User for the SSH service nobody : This user exists for processes that should have minimal privileges. However, here it has UID and GID 0 ( 0:0 ), meaning it has root privileges. Very dangerous. admin : Even though the name is not root, it acts like it. The password is MD5-crypt ( $1 ) and has no salt. I cracked the admin password with hashcat using the rockyou.txt wordlist. After a couple of seconds it broke. Guess what, the password is 1234 . This may be useful later. After this initial recon, I decided to wait until I had the router to analyze the firmware that came with it. P.S.: At the moment of writing this post I’ve discovered that if you change the language of the firmware download page to English, there are two additional firmware images available, both newer than the ones that appeared in the Spanish section. (Pretty odd, huh?) 2. Hardware Analysis In this section we’ll identify the main components of the router and their functionality. The first thing I had to do once I got the router was to open it. The device only had two small screws on its back. Figure 4: Router front view Figure 5: Router back view After removing them, I used a flat screwdriver to fully open it (I admit it was kind of tricky—maybe I should get a spudger). This is the inside of the ...