/CASE · 2026-08-17
Case: vendor gateway, unused parser fields
Authorized firmware review. Composite of more than one engagement. No vendor named, no exploit shipped. The useful part is the sequence.
A manufacturer sent us a gateway image and a letter that named that image. They wanted to know what the box would accept on the local HTTP surface before a retail SKU freeze. They did not want a red-team circus on devices already in the field.
Composite: details mixed so this is not a fingerprint of one customer. The sequence is real. The bytes in this note are not theirs.
What we did first
Hashed the image. unblob. Squashfs. Inventory: busybox, a vendor httpd, dropbear with a default key in a world-readable file, an updater that took a tarball over HTTP with no signature. The default key and the unsigned update were already findings. We still had to answer the parser question.
The parser
jadx was irrelevant. Ghidra on httpd. A POST handler copied a JSON body into a struct the decompiler drew as four fields. Access patterns said more: loads at +0x10 and +0x14 that no caller in the web UI ever set. Static guess: extra fields the mobile app had forgotten, or a debug overlay.
Unicorn on that function, fake buffer, offsets touched: 0x00, 0x04, 0x08, 0x10, 0x14. Confirmed. We did not then write a public PoC. We wrote: “the daemon reads two fields the UI never sends. If you ever expose this struct on a less trusted path, those fields are live.” The customer’s own lab client could set them. That was in-scope. The internet was not.
What left with them
- Filesystem inventory and hashes.
- Default dropbear key — rotate, do not just chmod.
- Unsigned update path — sign or stop shipping.
- Struct note for the HTTP body, confirmed offsets, two unused-but-live fields.
- What we did not do: no mass scan of deployed units, no exploit module.
Why this is the case we teach
We unpacked honestly, inventoried the boring secrets, then confirmed the one parser in scope. Tool combination from the firmware note and the offset oracle. If your vendor report is only a binwalk tree, you stopped at the copy.