Table of Contents

• What is this blog and why you should read this
• Routers are used to route
• How to source such routers
• How firmware updates work on these old routers
• The Vulnerability
• How to find such vulnerabilities
• Exploit, Exploit, Exploit
  • Thunderbird (ERLite-3)
  • Niffler (GL-AR150-POE)
• Cool…but how does it impact me? What are the likelihood of this happening to me? How do I mitigate it?
  • Impact
  • Likelihood
  • Mitigation
• Closing

What is this blog and why you should read this

This blog acts as a report on my first hacking project where I took pretty old but actively used SOHO routers and exploited a vulnerability where a bad actor can upload a modified firmware and the router will happily accept it as long as it passes a simple checksum. Now even though this is not an attempt to find a novel CVE but it documents my journey during this project, this report could be useful to you if you are planning to buy one or already own one of the routers mentioned in this post or any other router that was manufactured as late as 2020 but are now discontinued. And though this class of vulnerability is well documented in embedded security research, I could not find anyone who had specifically documented it on the ERLite-3 running EdgeOS 3.x, which is still receiving updates on hardware that is over a decade old. That is what makes it worth writing about. But in case you are a seasoned security researcher and were handed a link to this blog by yours truly, I will be in need of a job soon and it would be wonderful if you can read this and say “Oh my god we should hire this guy” (a man can hope).

I have always loved going to security meetups. When I first moved to Boston, it was meetups like OWASP Boston, Boston Security, and my favourite, Boston Hackers, that pulled me in. Now I am just back from the second day of the biggest security conference I have ever been to, sitting on my bed in a nice hotel in NYC and writing this blog post (unlike some nerds who are probably partying at the Lucky 13 Saloon).

note: if learning about the attacks on AD directory is the goal, check out: https://github.com/Orange-Cyberdefense/GOAD. This blog is focused on demonstrates my knowledge of enumeration and exploitation of active directory.

According to microsoft’s website, Active Directory (AD) provides the methods for storing directory data and making this data available to network users and administrators.
In simple words, it’s a phone book that can be accessed over a network which contains information on computers, user, printers etc. Authentication on windows is done through Kerberos and Kerberos Tickets. For other systems (linux, mac) it uses protocols like RADIUS, LDAP (Lightweight Directory Access Protocol).

This writeup was generated using an LLM (Claude) based on penetration testing notes available at: [GitHub Repository Link]

Target: 10.0.2.3
Date: August 25, 2025
Result: Root access achieved

Network Discovery

netdiscover -r 10.0.2.0/24

Target identified at 10.0.2.3

Port Scan

nmap -p- 10.0.2.3

OS: Linux 2.4.X (Red Hat)

FirmXRay

link : https://github.com/OSUSecLab/FirmXRay

A static analysis tool based on Ghidra to detect Bluetooth link layer vulnerabilities from bare-metal firmware. As proof-of-concept, the current implementation supports firmware (ARM Cortex-M Architecture) developed based on Nordic and TI SDKs (i.e., SoftDevice and BLE-Stack).

The three main components of FirmXRay are:

1. Base address recognition. It can automatically infer the firmware base address using the point-to relation heuristics. The output result will be in ./base/base.txt.
2. Backward slicing. FirmXRay will start from the SDK APIs and backward extract the relevant program paths.
3. Static value computation. FirmXRay can statically execute ARM instructions to compute the configuration values from the program slices.

For more details, please refer to our paper FirmXRay: Detecting Bluetooth Link Layer Vulnerabilities From Bare-Metal Firmware.