The £3 WiFi Extender With a Backdoor in Every Unit Pulling the firmware off the flash chip, decompressing the kernel, and finding an undocumented root login the owner cannot change. Keiran Smith Aug 30, 2026 Share Every one of these devices ships with the same root password. It is a nine-character constant compiled into the vendor’s control daemon, it belongs to an account the owner is never told about and cannot permanently change, and a telnet daemon is started unconditionally on every boot to serve it. Nothing filters inbound connections either, so it is reachable from the network the extender is bridging to and not just from its own WiFi. The thing cost three pounds and arrived in a fortnight, and there are a great many of them sitting in people’s homes right now. It came from one of those algorithmically-suggested Temu listings that is too good to scroll past: a “WiFi signal booster / range extender”, six antennas, dramatic coverage diagrams, and a price somewhere south of a coffee. Hardware that cheap is almost never designed by whoever is selling it. What you are actually buying is a whitelabel reference design, which means the security posture the original ODM shipped with is the one every reseller’s customers inherit, and none of those customers have any idea whose code is really running. Affix' Security Musings is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber. Subscribe None of that is visible from the outside, and there is no firmware download anywhere to inspect, so the only way to find out was to take the bytes off the flash chip ourselves. That is worth doing even when a download does exist, because the image on the chip is the image that is really running, complete with the vendor’s NVRAM defaults and any partition an update package would never contain. In this write-up we will open the device, work out what is actually inside it, read the SPI flash with a Bus Pirate, carve the kernel and the root filesystem out of the dump, and then follow the strings in that control daemon until the account falls out of the disassembly. The hardware half is the easy half. The interesting part is what strings and a MIPS disassembler tell us afterwards. What are we even holding? Before any probing it is worth asking what the device claims to be, because the answer turned out to be “nothing in particular”. The listing had a brand name on it, but a brand on a Temu listing is a marketing label, not an identity. So we open it up and let the board tell us the truth. A shambles of antenna wiring The enclosure pops open with a spudger and a bit of persuasion. Inside is a single blue PCB, four external dipoles on u.FL pigtails, two Ethernet jacks, and three obvious chips. There is no FCC ID that resolves to anything useful, no model number moulded into the case, and crucially no brand string anywhere we will later find in the firmware either. The one piece of stable identity is printed on the board itself. 4/6 Antennas don’t even connect to anything There it is in the corner: Z05L V1.0 . That is the closest thing to a model name this device has, so that is what we will call it. Do not skip this step. If you name your research after the box it came in, you will confidently publish the wrong manufacturer, and someone will rightly pull you up on it. Reading the silicon A board is only as interesting as the parts on it, so we identify the three big chips before deciding how to attack it. Chip markings on cheap hardware are often faint, laser-etched into a matte package, and best read with raking light from a phone torch. The brains, A MediaTek MT7620 The main SoC is a MediaTek part. The etch is worn but the family is unmistakable, and the firmware confirms it later: the NVRAM carries Platform=RT7620 and the WiFi calibration EEPROM starts with the chip ID 0x7620 . That makes this an MT7620 , a MIPS24KEc-based 2.4 GHz WiFi SoC that MediaTek inherited from Ralink, which is exactly why the firmware is riddled with ra0 , iwpriv and “RALINK” strings. It is the workhorse of a decade of cheap routers and repeaters. Some good, low quality RAM The RAM is an EtronTech EM68B16CWQH-25H , a DDR2 SDRAM. Nothing exotic, and not something we need to touch, but worth recording so the board can be matched against others of the same reference design. The chip we actually care about is on the reverse. The reverse of the board, Not much to look at An eight-legged SOIC-8 sat on its own on the back of the board is almost always the SPI NOR flash, and this is no exception. Ol’ Faithful the winbond 25Q32BVSIG Under magnification it reads winbond 25Q32BVSIG 1126 . That is a Winbond W25Q32BV , a 32 Mbit (4 MB) SPI flash in the industry-standard 25-series pinout, and the 1126 is a 2011 week-26 date code. This single chip holds the bootloader, the kernel, the root filesystem and the configuration. If we can read it, we have everything. Why the flash chip, and why a Bus Pirate? Th...