# I Reverse Engineered This Temu Router and Found Something Dangerous Source: https://www.youtube.com/watch?v=KsiuA5gOl1o Recap page: https://rapidrecap.app/video/KsiuA5gOl1o Generated: 2026-03-02T16:37:10.688+00:00 --- ## Quick Overview The security researcher successfully achieved root shell access on a cheap Temu Wi-Fi extender by exploiting a command injection vulnerability in the device's `protocol.csp` endpoint, specifically by injecting a command into the `time` parameter that executed `/usr/sbin/telnetd` to establish a remote shell, confirming the device was running as root. **Key Points:** - The researcher bought a cheap Wi-Fi signal extender from Temu for approximately $5, down from an original $30, to search for embedded vulnerabilities. - An initial command injection vulnerability was found in the device's setup interface by injecting `$reboot` into the WiFi Password field, which caused the device to soft-brick. - Further analysis of the device's firmware revealed a web service endpoint at `192.168.11.1/protocol.csp` that accepted `fname` and `opt` parameters, alongside a time-based parameter that was unsanitized. - By crafting a URL request that injected a command to execute `/usr/sbin/telnetd -l /bin/ash -p 4444`, the researcher successfully opened a Telnet shell on the device. - The device was running BusyBox v1.25.1 and the resulting shell confirmed execution as root (uid=0, gid=0), indicating severe security flaws. - The vulnerability stems from poor input validation in the `time_conf` function within the `commuos` binary, which processes the unsanitized time parameter from the web request. ![Screenshot at 00:02: The researcher holds up the cheap white Wi-Fi repeater device purchased from Temu, marking the start of the hardware hacking exercise.](https://ss.rapidrecap.app/screens/KsiuA5gOl1o/00-00-02.jpg) **Context:** The video documents a hardware security researcher's process of reverse-engineering a low-cost Wi-Fi signal extender purchased from Temu to identify and exploit security vulnerabilities. The process involves initial device interaction, firmware extraction, static analysis using Ghidra, network traffic inspection, and finally, command injection via a web endpoint to gain remote command execution on the embedded system. ## Detailed Analysis The researcher begins by showcasing a cheap Wi-Fi extender purchased from Temu for about $5, which they intended to reverse engineer for vulnerabilities. Initial attempts involved inputting `$reboot` into the setup password field, which caused the device to soft-brick. After recovering the device, the researcher examined the network traffic when interacting with the setup page (`192.168.11.1/home.html`), noticing a POST request to `/protocol.csp` containing parameters like `fname=net&opt=time_conf&time=asdfasdf&math=0.6709722512707119&function=set`. The `time` parameter appeared unsanitized. By analyzing the extracted firmware using Ghidra, the researcher located the relevant function, `time_conf`, within the `commuos` binary. This function was found to use `sprintf` to format the `time` parameter into a buffer before calling `doSystemCmdLib`, leading to command injection. The researcher crafted a payload to execute `/usr/sbin/telnetd -l /bin/ash -p 4444` via the time parameter. After successfully uploading and executing this payload, the researcher connected to the device on port 4444 using Netcat, obtaining a BusyBox shell where running the `id` command confirmed they had root access (uid=0, gid=0), demonstrating a critical RCE vulnerability. ### Initial Device Analysis - Purchased a Temu Wi-Fi repeater for $4.71; initially tested command injection in the setup interface with `$reboot`, causing a soft-brick. ### Firmware Analysis & Web Interface - Extracted firmware and used Ghidra on `commuos` binary; inspected network traffic revealing a vulnerable POST request to `/protocol.csp` with an unsanitized `time` parameter. ### Vulnerability Exploitation - Crafted a command injection payload using the structure `&time=$(/usr/sbin/telnetd -l /IFS/tmp/tmpFW/webs/hehe -p 4444$IFS/bin/ash)` to establish a reverse shell. ### Gaining Root Shell - Executed the exploit via `curl` against the device's web interface, resulting in a BusyBox shell connection on port 4444. ### Privilege Confirmation - Running the `id` command on the established shell confirmed execution as root (uid=0, gid=0), demonstrating the severity of the vulnerability. ### Code Review Insights - Analyzed the `time_conf` function in Ghidra, noting it uses `sprintf` on the request parameter without proper sanitization before executing it via `doSystemCmdLib`, confirming the path for the command injection. ![Screenshot at 00:02: The researcher holds up the cheap white Wi-Fi repeater device purchased from Temu, marking the start of the hardware hacking exercise.](https://ss.rapidrecap.app/screens/KsiuA5gOl1o/00-00-02.jpg) ![Screenshot at 00:09: The Temu product listing showing the Wi-Fi repeater device, originally priced at $29.99, now on sale for $4.71.](https://ss.rapidrecap.app/screens/KsiuA5gOl1o/00-00-09.jpg) ![Screenshot at 00:48: The device's initial web setup interface showing options for Repeater, AP, and Router Mode settings.](https://ss.rapidrecap.app/screens/KsiuA5gOl1o/00-00-48.jpg) ![Screenshot at 01:01: The researcher enters the command injection payload $\(reboot\) into the WiFi Password field, demonstrating the command execution feature.](https://ss.rapidrecap.app/screens/KsiuA5gOl1o/00-01-01.jpg) ![Screenshot at 02:26: The device's Breed Web Recovery Console interface, accessed after exploiting the boot process, showing system information like CPU and flash size.](https://ss.rapidrecap.app/screens/KsiuA5gOl1o/00-02-26.jpg)