Category: Hacking

The RG2100 turned out to be a very hackable little hotspot. This final part collects the security lessons and summarises the full chain. What went wrong with the design This was an enjoyable device to work on, but it has some obvious security problems. SIM unlock. The unlock code should not be derived from public…… Continue reading Part 7: Security Reflections and Wrap-Up

The current RG2100 firmware did not ship with a ready-to-run SSH daemon. The goal here was a small, signed OTA that installs Dropbear and a systemd service, without flashing boot, modem, or recovery partitions. Borrowing Dropbear from older firmware An older R717 firmware included Dropbear and a compatible glibc runtime. The useful files were copied…… Continue reading Part 6: Building a Signed SSH OTA Package

To install SSH persistently without hand-editing the live filesystem, I needed to understand how Franklin packages and applies updates. This part covers the FOTA check-in flow, recovery behaviour, and PAC container format. FOTA check-in The OTA endpoint follows this pattern: https://fota.pintracview.com/fota/RG2100/check_update.php?carrier=<CARRIER>&rev=<CURRENTVERSION>&imei=<IMEI> The device checks in with a carrier, current revision, and IMEI. Supplying an older…… Continue reading Part 5: Understanding the OTA System and PAC Format

With root access and a filesystem dump in hand, two practical changes were next: removing the SIM lock and switching the carrier branding from T-Mobile to the generic DEFAULT profile. SIM unlock page The SIM unlock page lives in the ordinary web UI, not only in the hidden menus: http://192.168.0.1/settings/mobile_network-sim.html The interesting code path is…… Continue reading Part 4: SIM Unlock and Debranding

A www-data reverse shell is useful for enumeration, but the RG2100 also exposes root ADB through a surprisingly simple USB composition change. USB composition control USB mode is controlled by: /etc/data/default_usb On this unit the file permissions were unexpectedly permissive: -rwxrw-rw- 1 radio radio /etc/data/default_usb So even though the web command-execution path was not root,…… Continue reading Part 3: Root ADB and Filesystem Backups

The first practical foothold on the RG2100 came from the web interface, not from ADB or a serial console. The vulnerable endpoint While reviewing JavaScript and CGI endpoints, the software update page stood out. The UI posts firmware uploads to: /cgi-bin/file_send.cgi?command=fw_download The public device software update page builds a multipart upload using the fw_download command.…… Continue reading Part 2: Command Injection via the Firmware Upload

Before any exploitation, it helps to know how the device presents itself on the network, what the stock admin UI reveals, and where the less obvious interfaces live. Network layout The RG2100 exposes a USB network interface. In my setup the host and device sat on separate subnets from my normal Wi-Fi connection: Host USB/RNDIS…… Continue reading Part 1: Getting Started with the Franklin RG2100

A practical write-up of poking at a Qualcomm SDX65-based Franklin hotspot: finding a web UI command injection, working out the SIM lock, enabling root access, and building a small signed OTA package that installs SSH without replacing the whole firmware. This is not the Franklin R717/T9. The device here is an RG2100, reported by the…… Continue reading Rooting, Unlocking, and Debranding the Franklin RG2100