Case Study (Led to a CVE Update)
In this chapter, we provide a practical example of how to hack your first IoT device and dive into the world of hardware hacking.
I found an old Asus RT-N12 D1 router in my basement, which had been replaced long ago and was laying around. A perfect candidate for a hardware hacking project! Spoiler: I successfully identified a vulnerability, which led to Asus updating CVE-2024-28326 to include the RT-N12 D1 model.
Reconnaissance
OSINT
The first step in any hardware hacking project is research. I started by Googling the router model number, "ASUS RT-N12 D1", and came across an article about a similar model, the ASUS RT-N12+ B1. The article mentioned that the device had an open UART interface allowing unauthenticated root access. However, it provided no exact details on how to exploit this or where the UART interface might be located. Could my router model have the same vulnerability?
To gather more information, I turned to the FCC ID printed on the back of the router:
In the United States, any device that uses RF communication, such as a router, must have an FCC ID. The Federal Communications Commission publishes detailed reports, including internal photos of devices. This allows us to inspect the internal hardware without even opening the device!
Upon reviewing the FCC documentation, I noticed four connector pads on the top-right section of the PCB. This layout is very typical for a UART interface, which usually consists of four pins: RX, TX, VCC, and GND.
Open the device
With enough reconnaissance completed, it was time to open the router and take a closer look at the hardware. The primary goals were:
Identifying components of interest (e.g., flash chips, RAM).
Locating debug ports and interfaces.
Tip: Always take photos of your device and label components as you identify them—this will help you stay organized.
As we can see next to the flash chip there are 4 connector pins. Using a multimeter, we can try to identify each of the pins performing a continuity test. For that we need test points for ground and power. We can use the GND and VCC pins of the flash chip as a reference, since we can look them up on the datasheet of the flash chip.
Using this method we can easily identify GND and VCC. To distinguish TX and RX pins, we can power on the device and see that one of the pin has a fluctuating voltage ranging from 1.8 to 3.3 V. This pin should be the TX pin of the UART interface. Hence, we got this layout:
Interface Interaction
To interact with the UART interface, I used a USB-to-UART TTL adapter. The connections were made as follows:
Router TX → Adapter RX
Router RX → Adapter TX
GND → Adapter GND
Note: Instead of soldering the GND pin, I used a clip on the flash chip for simplicity.
With everything connected, I used Minicom to set the baud rate to 115200 and powered on the router. Immediately, the boot log was printed!
Even better: once the router finished booting, the UART interface provided an unauthenticated root shell!
Post Exploitation
With root access, I could analyze the router’s internals:
Inspect running processes
Check installed programs
Retrieve sensitive information
For example, if you ever forget your router’s password, you can simply read it in plaintext:
Responsible Disclosure
I responsibly reported the vulnerability to Asus, which led to the following timeline:
09.11.2024 – Reported the vulnerability via Asus Security Advisory.
18.11.2024 – Received an email from Asus suggesting I update to the latest firmware and retry. They also noted that the "model has been End-of-Life (EOL) for several years and will no longer receive firmware maintenance."
18.11.2024 – Confirmed the vulnerability still exists in the latest firmware and submitted detailed findings to Asus.
17.12.2024 – Asus acknowledged the vulnerability and updated CVE-2024-28326 to include the RT-N12 D1 router.
Resources
https://nvd.nist.gov/vuln/detail/CVE-2024-28326#VulnChangeHistorySection
Last updated
Was this helpful?