I Reverse Engineered This Temu Router and Found Something Dangerous

Quick Overview

The security researcher successfully achieved root shell access on a cheap Temu Wi-Fi extender by exploiting a command injection vulnerability in the device's endpoint, specifically by injecting a command into the parameter that executed to establish a remote shell, confirming the device was running as root.

Key Points: The researcher bought a cheap Wi-Fi signal extender from Temu for approximately $5, down from an original $30, to search for embedded vulnerabilities. An initial command injection vulnerability was found in the device's setup interface by injecting into the WiFi Password field, which caused the device to soft-brick. Further analysis of the device's firmware revealed a web service endpoint at that accepted and parameters, alongside a time-based parameter that was unsanitized. By crafting a URL request that injected a command to execute , the researcher successfully opened a Telnet shell on the device. The device was running BusyBox v1.25.1 and the resulting shell confirmed execution as root (uid=0, gid=0), indicating severe security flaws. The vulnerability stems from poor input validation in the function within the binary, which processes the unsanitized time parameter from the web request.

Context: The video documents a hardware security researcher's process of reverse-engineering a low-cost Wi-Fi signal extender purchased from Temu to identify and exploit security vulnerabilities. The process involves initial device interaction, firmware extraction, static analysis using Ghidra, network traffic inspection, and finally, command injection via a web endpoint to gain remote command execution on the embedded system.

Detailed Analysis

The researcher begins by showcasing a cheap Wi-Fi extender purchased from Temu for about $5, which they intended to reverse engineer for vulnerabilities. Initial attempts involved inputting into the setup password field, which caused the device to soft-brick. After recovering the device, the researcher examined the network traffic when interacting with the setup page ( ), noticing a POST request to containing parameters like . The parameter appeared unsanitized. By analyzing the extracted firmware using Ghidra, the researcher located the relevant function, , within the binary. This function was found to use to format the parameter into a buffer before calling , leading to command injection. The researcher crafted a payload to execute via the time parameter. After successfully uploading and executing this payload, the researcher connected to the device on port 4444 using Netcat, obtaining a BusyBox shell where running the command confirmed they had root access (uid=0, gid=0), demonstrating a critical RCE vulnerability.