Summary

I bought a Mercusys (MW325R EU V3) router and found a login page vulnerability during reverse engineering. Using HW hacking tools, I obtained a root shell and discovered the custom-made OS with a "MiniFS" filesystem. I reported multiple vulnerabilities to the vendor, focusing on CVE-2023-46297.

Description