A practical write-up of poking at a Qualcomm SDX65-based Franklin hotspot: finding a web UI command injection, working out the SIM lock, enabling root access, and building a small signed OTA package that installs SSH without replacing the whole firmware.
This is not the Franklin R717/T9. The device here is an RG2100, reported by the system as SDXLEMUR-LITE-MTP and built around a Qualcomm SDX65 Linux platform.
The work below was done on my own hardware, for research and personal use. Treat everything as at your own risk. Do not run arbitrary commands on a device you depend on. Back up anything device-specific before touching branding, factory-reset scripts, modem configuration, or persistent storage. The factory tooling on this unit can write the IMEI, Wi-Fi MAC addresses, Ethernet MAC address, carrier brand, and MCFG files, a casual-looking command can have lasting consequences.
The chain, in brief
- Find command execution in the web firmware upload endpoint via shell expansion in the uploaded filename.
- Use
loggerand callback HTTP requests to turn that into a practical command-output channel. - Turn the same bug into a reverse shell.
- Use the web shell to change the USB composition and expose root ADB.
- Dump and inspect the filesystem.
- Reverse the SIM unlock code path in
QCMAP_Web_CLIENT. - Apply the model-aware SHA-1 unlock formula.
- Carefully debrand with
fti_factory_reset.sh DEFAULT perm,all,reboot. - Analyse recovery, FOTA, PAC packing, encryption, and signatures.
- Reuse Dropbear from an older Franklin firmware.
- Build a small signed OTA that installs only an SSH service and runtime files.
The most important practical takeaway: the OTA system is script-driven. A carefully built package can add or replace a small number of files without flashing full images or touching the modem or boot partitions. That makes controlled modifications possible — but the integrity model is only as strong as the key handling, and in this firmware the key handling is not strong.
Series contents
| Part | Title | What it covers |
|---|---|---|
| 1 | Getting Started | Network setup, admin UI, filesystem layout, hidden web interfaces |
| 2 | Command Injection | The fw_download filename bug, output channels, reverse shell |
| 3 | Root ADB and Backups | USB compositions, root shell, filesystem and MTD dumps |
| 4 | SIM Unlock and Debranding | Unlock formula, carrier branding, fti_factory_reset.sh |
| 5 | OTA and PAC Format | FOTA endpoints, recovery mounts, encryption, signatures |
| 6 | Building an SSH OTA | Dropbear runtime, updater-script, AppleDouble trap, final packages |
| 7 | Security and Wrap-Up | What went wrong with the design, lessons learned |
Start with Part 1: Getting Started.