TLDR Tech / InfoSec
The £3 WiFi Extender With a Backdoor in Every Unit
A £3 Z05L WiFi extender uses an MT7620 chip and a four-megabyte Winbond flash. Its firmware starts Telnet on every boot with root password 198277tt@, and the web API accepts requests without session checks, so a mac parameter can reach system() without validation, allowing root command injection. Firmware updates verify CRC32 values only, allowing forged images, and the firewall leaves inbound services exposed on bridged networks as the config partition stores WiFi credentials in plaintext.
Read the full story