JPDoe at 12:07, 18 May 2020

2020-05-18T12:07:56Z

← Older revision		Revision as of 12:07, 18 May 2020
Line 2,783:		Line 2,783:
	* https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wireless_routers_n300/br-6428nc		* https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wireless_routers_n300/br-6428nc
	* https://www.edimax.com/edimax/download/download/data/edimax/global/download/product/wireless_routers/wireless_routers_n300/br-6428nc/		* https://www.edimax.com/edimax/download/download/data/edimax/global/download/product/wireless_routers/wireless_routers_n300/br-6428nc/

	~~[[Category:Hidden]]~~

JPDoe at 12:07, 18 May 2020

2020-05-18T12:07:07Z

← Older revision		Revision as of 12:07, 18 May 2020
Line 2,783:		Line 2,783:
	* https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wireless_routers_n300/br-6428nc		* https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wireless_routers_n300/br-6428nc
	* https://www.edimax.com/edimax/download/download/data/edimax/global/download/product/wireless_routers/wireless_routers_n300/br-6428nc/		* https://www.edimax.com/edimax/download/download/data/edimax/global/download/product/wireless_routers/wireless_routers_n300/br-6428nc/

			[[Category:Hidden]]

JPDoe at 12:04, 18 May 2020

2020-05-18T12:04:59Z

← Older revision		Revision as of 12:04, 18 May 2020
Line 2,783:		Line 2,783:
	* https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wireless_routers_n300/br-6428nc		* https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wireless_routers_n300/br-6428nc
	* https://www.edimax.com/edimax/download/download/data/edimax/global/download/product/wireless_routers/wireless_routers_n300/br-6428nc/		* https://www.edimax.com/edimax/download/download/data/edimax/global/download/product/wireless_routers/wireless_routers_n300/br-6428nc/

	~~[[Category:Documentation]]~~

JPDoe: Initial submit

2020-04-26T17:51:44Z

Initial submit

New page

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>
</div>

<h1>Summary</h1>
<span style="font-size: 50px; line-height: 30px; padding-left: 10px">⚒</span>
<p style="text-align: justify"></p>

<h1>Introduction</h1>
<span style="font-size: 50px; line-height: 30px; padding-left: 10px">⚒</span>
<p style="text-align: justify"></p>

<h1>Examination</h1>

<h2>Summary</h2>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ Collected Information</div>
<div class="mw-collapsible-content">

<table class="wikitable" style="background-color: white">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Device Model</td>
<td style="border-color: black">XT2 Plus</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Manufacturer</td>
<td style="background-color: white; border-color: black">Edimax</td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">Product Type</td>
<td style="background-color: white; border-color: black">Router</td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">Description</td>
<td style="background-color: white; border-color: black">3-in-1 Router, AP, and Range Extender</td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">Price on Release</td>
<td style="background-color: white; border-color: black">30 Euro</td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">Release</td>
<td style="background-color: white; border-color: black">2015 Q1 (Continuing as of April 2020)</td>
</tr>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey;border-color: black">State of Research</td>
<td style="background-color: white; border-color: black">It was not possible to enable input via UART; the board shows several soldering points; Only bootlog information could be capured</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Ports</td>
<td style="background-color: white; border-color: black">4xGbE, 2xWLAN Antenna</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Buttons</td>
<td style="background-color: white; border-color: black">WPS/Reset</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">LED</td>
<td style="background-color: white; border-color: black">Power, WLAN, WAN, 4xLAN</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Power</td>
<td style="background-color: white; border-color: black">5V/1A DC</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">WLAN</td>
<td style="background-color: white; border-color: black">2,4GHz 802.11b/g/n up to 300MBit/s</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Other</td>
<td style="background-color: lightgrey;border-color: black">N/A</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">FCC-ID</td>
<td style="background-color: white; border-color: black">NDD9564281303</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">System</td>
<td style="background-color: white; border-color: black">REALTEK RTL8691E</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Processor</td>
<td style="background-color: white; border-color: black">RTL8196E 2014.09.22 v0.3 [16bit] (380MHz)</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">BogoMIPS</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Memory</td>
<td style="background-color: white; border-color: black">DRAM: 16MB [16bit]</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Storage</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Ethernet MAC</td>
<td style="background-color: white; border-color: black">74:DA38:F8:DE:E5</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">WLAN MAC</td>
<td style="background-color: lightgrey;border-color: black">74:DA38:F8:DE:E4</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">WLAN SSID</td>
<td style="background-color: lightgrey;border-color: black">edimax.setup (Changed during setup)</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">WLAN PSK</td>
<td style="background-color: lightgrey;border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Default IPv4</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Hostname</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">NET Protocols</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Interfaces</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Ports</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Webpage</td>
<td style="background-color: white; border-color: black">https://edimax.setup</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Webaccess</td>
<td style="background-color: white; border-color: black">admin: 1234</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">Root Password</td>
<td style="background-color: white; border-color: black"></td>
<tr>
<td style="background-color: darkgrey; border-color: black">Other Login Pw</td>
<td style="background-color: lightgrey;border-color: black"></td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr style="border-width: 2px 2px 0 2px;>
<td style="background-color: darkgrey; border-color: black">Firmware</td>
<td style="background-color: white; border-color: black">v1.16</td>
</tr>
<tr style="border-width: 0 2px 2px 2px;>
<td style="background-color: darkgrey; border-color: black">Hardware</td>
<td style="background-color: white; border-color: black">Rev. A</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr style="border-width: 2px 2px 0 2px;>
<td style="background-color: darkgrey; border-color: black">Baudrate</td>
<td style="background-color: white; border-color: black">38400 (8N1)</td>
</tr>
<tr style="border-width: 0 2px;>
<td style="background-color: darkgrey; border-color: black">Bootdelay</td>
<td style="background-color: white; border-color: black">1s</td>
</tr>
<tr style="border-width: 0 2px;>
<td style="background-color: darkgrey; border-color: black">Bootloader</td>
<td style="background-color: white; border-color: black">Access by pressing ESC or the WPS button on boot.</td>
</tr>
<tr style="border-width: 0 2px;>
<td style="background-color: darkgrey; border-color: black">mtdparts</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="border-width: 0 2px;>
<td style="background-color: darkgrey; border-color: black">Filesystem</td>
<td style="background-color: white; border-color: black">squashfs</td>
</tr>
<tr style="border-width: 0 2px;>
<td style="background-color: darkgrey; border-color: black">Image</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="border-width: 0 2px;>
<td style="background-color: darkgrey; border-color: black">Linux</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="border-width: 0 2px 2px 2px;>
<td style="background-color: darkgrey; border-color: black">Kernel cmdline</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr style="border-width: 2px 2px 0 2px;>
<td style="background-color: darkgrey; border-color: black">Shell</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="border-width: 0 2px;>
<td style="background-color: darkgrey; border-color: black">BusyBox</td>
<td style="background-color: white; border-color: black"></td>
</tr>
<tr style="border-width: 0 2px 2px 2px;>
<td style="background-color: darkgrey; border-color: black">Services</td>
<td style="background-color: white; border-color: black"></td>
</table>

</div>
</div>
</div>

<h2>Network Mapper</h2>
<div class="toccolours mw-collapsible" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>Edimax BR-6428nC</b>: N300 Multi-Function Wi-Fi Router</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<b>Wide Area Network (WAN)</b>
<span><nowiki>Host is up.
All 1000 scanned ports on 192.168.86.40 are filtered</nowiki></span>

<b>Local Area Network (LAN)</b>
<span><nowiki>PORT STATE SERVICE VERSION</nowiki></span>
<span><b>80</b><nowiki>/tcp open http Boa HTTPd 0.94.14rc21</nowiki></span>
<span><nowiki>| http-auth: </nowiki></span>
<span><nowiki>| HTTP/1.1 401 Unauthorized\x0D</nowiki></span>
<span><nowiki>| Server returned status 401 but the WWW-Authenticate header could not be parsed.</nowiki></span>
<span><nowiki>|_ WWW-Authenticate: </nowiki><b>Basic realm="Default Name:admin Password:1234</b></span>
<span><nowiki>|_http-server-header: Boa/0.94.14rc21</nowiki></span>
<span><nowiki>|_http-title: 400 Bad Request</nowiki></span>
<span><nowiki></nowiki></span>
<span><b>52881</b><nowiki>/tcp open upnp MiniUPnP</nowiki></span>
</div>
</div>
</div>

</div><p style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px;"><b>Note</b>: This scan has been executed after a basic setup without applying any custom firmware configuration.</p>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: The webserver is communicating the default credentials.</div>

<h2>Web Interface</h2>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto">
<div style="line-height:1.6;">ⓘ <b>Edimax BR-6428nC</b>: Setup</div>
<div class="mw-collapsible-content">

<gallery caption="Wifi-Router Mode" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=300px>
image:Edimax BR-6428nC wepage 1 aindex.png|aindex.asp
image:Edimax BR-6428nC wepage 2 wiz 3in1.png|wiz_3in1.asp
image:Edimax BR-6428nC wepage 3 hwsetup.png|hwsetup.asp
image:Edimax BR-6428nC wepage 4 detect.png|detect.asp
image:Edimax BR-6428nC wepage 5 aconnected.png|aconnected.asp
image:Edimax BR-6428nC wepage 6 wifi.png|wifi.asp
image:Edimax BR-6428nC wepage 7 conclusion.png|conclusion.asp
image:Edimax BR-6428nC wepage 8 last.png|last.asp
</gallery>

</div>
</div>
</div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto">
<div style="line-height:1.6;">ⓘ <b>Edimax BR-6428nC</b>: Configuration</div>
<div class="mw-collapsible-content">

<span style="font-size: 50px; line-height: 30px; padding-left: 10px">⚒</span>

<gallery caption="LUPUS XT2 Plus: Unauthorized Login" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=250px>
image:
</gallery>

</div>
</div>
</div>

<p style="text-align: justify"></p>

<h2>Physical Intervention</h2>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>Edimax BR-6428nC</b>: N300 Multi-Function Wi-Fi Router</div>
<div class="mw-collapsible-content">

<gallery id="LUPUS_XT2_Plus_PCB" caption="Edimax BR-6428nC: Main Printed Circuit Board" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=250px>
image:Edimax_BR-6428nC_PCB_Front.jpg|Front
image:Edimax_BR-6428nC_PCB_Back.jpg|Back
</gallery>

</div>
</div>

<h3>SoC</h3>

[[File:REALTEK_RTL8196E_Pin_Assignment.png|230px|right|thumb|REALTEK RTL8196E Soc<sup>[[http://www.hytic.net/upload/files/2015/09/REALTEK-RTL8196E.pdf Datasheet]]</sup>: Investigated PIN reference]]
<p style="text-align: justify">The main processor, referred to as MCU here, is a REALTEK "RTL8196E" Soc and has a Thin Quad Flat Package (TQFP) with 128 leads on the side. Although this chip has a lead density of 24 leads/cm, it is still possible to hook up to them. This could also be used to intercept other information streams in and out of the MCU. Even if this in itself should not have a security risk in the actual use of the device! The MCU was only examined for the availability of an active UART.</p>

<h4>UART</h4>
[[File:Edimax BR-6428nC PCB UART.jpg|230px|right|thumb|UART: PCB Pin Assignment]]
<span style="font-size: 50px; line-height: 30px; padding-left: 10px">⚒</span>
<p style="text-align: justify"></p>

<h4>Bootloader</h4>
The RTL8196E's bootloader can be accessed by pressing ESC or the WPS button on boot. Entering "help" or any other command command results in a "Unknown command !" after any try.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>Edimax BR-6428nC</b>: N300 Multi-Function Wi-Fi Router</div>
<div class="mw-collapsible-content">
<nowiki>
Booting...

********************************************************************************
*
* chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize
* 0000000h 0c22016h 00000c2h 0000020h 0000016h 0000000h 0000016h 0400000h
* blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName
* 0010000h 0000040h 0001000h 0000400h 0000100h 0000010h 000004eh MX25L3205D
*
********************************************************************************

---RealTek(RTL8196E)at 2014.09.22-15:02+0800 v0.3 [16bit](380MHz)
---Dram16M_16Mx1_16bit, TRX Timing: [T:16 R:08]
P0phymode=01, embedded phy

Unknown command !
ls
Unknown command !
help
Unknown command !
HELP
?
Unknown command !
IPCONFIG
Unknown command !
</nowiki>

</div>
</div>

<h4>Bootlog</h4>
Device in router-mode after a basic setup.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>Edimax BR-6428nC</b>: N300 Multi-Function Wi-Fi Router</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<nowiki>Booting...

********************************************************************************
*
* chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize
* 0000000h 0c22016h 00000c2h 0000020h 0000016h 0000000h 0000016h 0400000h
* blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName
* 0010000h 0000040h 0001000h 0000400h 0000100h 0000010h 000004eh MX25L3205D
*
********************************************************************************

---RealTek(RTL8196E)at 2014.09.22-15:02+0800 v0.3 [16bit](380MHz)
---Dram16M_16Mx1_16bit, TRX Timing: [T:16 R:08]
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
Realtek WLAN driver - version 1.6 (2013-02-21)
init started: BusyBox v1.11.1 (2015-09-24 13:24:39 CST)
starting pid 9, tty '': '-/bin/sh'

BusyBox v1.11.1 (2015-09-24 13:24:39 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

/bin/init.sh: /tmp/mssid.txt: line 5: wlan0-va0: not found
kill: you need to specify whom to kill
Close Wan Interface!!
dhcp mtu >> 1500
Initialize WLAN interface
>> 2.4G adaptivity enable !!

DO 8192E IQK !!!!
Done 8192E IQK !!!!

[selsect txpower] Normal txpower
[txpower] Current Channel : 1
[txpower] Enable Power Table
[txpower] CE Power Table
[txpower] 11b H->L rate index:4
[txpower] 11g H->L rate index:10
[txpower] 11n20M H->L rate index:10
[txpower] 11n40M H->L rate index:8
[txpower] 40/20M
Setup BRIDGE interface
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
bridge br0 doesn't exist; can't delete it
Setup bridge...

DO 8192E IQK !!!!
Done 8192E IQK !!!!

Static DHCP Leases disable!
Setup WAN interface
kill: you need to specify whom to kill
Close Wan Interface!!
>> WAN_MODE is 0
device eth1 is not a slave of br0
device eth0 is already a member of a bridge; can't enslave it to bridge br0.
**********************************************************************
* Enable WSC_UPnP *
**********************************************************************
**********************************************************************
* Enable LLTD *
**********************************************************************
**********************************************************************
* Enable GPIO Interrupt *
**********************************************************************
udhcpc (v1.11.1) started
into eth1.deconfig
Sending select for 192.168.86.40...
Lease of 192.168.86.40 obtained, lease time 86400
killall: radiusd: no process killed
RADIUS server disable !!
######## eth1.bound ########
cat: can't open '/tmp/pktmask': No such file or directory
adding dns 192.168.86.1
route: ioctl 0x890c failed: No such process
route: ioctl 0x890c failed: No such process
deleting routers
route: ioctl 0x890c failed: No such process
Notice: caching turned off

WiFi Simple Config v2.11-wps2.0 (2012.06.18-11:32+0000).

**********************************************************************
* FREE Page,Dentries and Inodes Cache *
**********************************************************************
IEEE 802.11f (IAPP) using interface br0 (v1.7)
MemFree: 2648 kB
Cached: 2204 kB
killall: crond: no process killed
Time server domain name=pool.ntp.org
Time server address=195.186.4.100
boa: server version Boa/0.94.14rc21
boa: server built Sep 24 2015 at 13:24:36.
boa: starting server pid=901, port 80
route: ioctl 0x890b failed: File exists
route: ioctl 0x890b failed: File exists</nowiki>
</div>
</div>
</div>

<h2>Firmware</h2>

<h4>Download</h4>
<h5>Current Version</h5>
<u>BR-6428nC</u>: https://www.edimax.com/edimax/download/download/data/edimax/global/download/product/wireless_routers/wireless_routers_n300/br-6428nc/<br>

</div><p style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px;"><b>Note</b>: The currently (18. April 2020) the official firmware version is v1.16. But, the version v1.17 is also downloadable. <br> Despite the fact that v1.17 seems to be the older version, which was created in October 2014 and the versions v.1.15 in Juli 2015 and v1.16 in September 2015.</p>

<h5>Known Versions</h5>
<u>BR-6428nC</u>:
* v1.17: https://www.edimax.com/edimax/mw/cufiles/files/download/Firmware/BR6428NC_v1.17.zip (Accessed 18. April 2020)
* v1.16: https://www.edimax.com/edimax/mw/cufiles/files/download/Firmware/BR6428NC_v1.16.zip (Accessed 18. April 2020) (To revise CGI Vulnerability.)
* v1.15: https://www.edimax.com/edimax/mw/cufiles/files/download/Firmware/BR6428NC_v1.15.zip (Accessed 18. April 2020)
* v1.07

</div><p style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px;"><b>Note</b>: Search for other available firmware versions: <code>wget https://www.edimax.com/edimax/mw/cufiles/files/download/Firmware/BR6428NC_v1.{0..50}.zip --max-redirect 0</code>

<h4>Extraction</h4>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; calc(100% - 12px); overflow:auto;">
<div style="line-height:1.6;">ⓘ <b>Edimax BR-6428nC</b>: N300 Multi-Function Wi-Fi Router</div>
<div class="mw-collapsible-content">
<div style="font-size: 12px !important">
<nowiki>
$ binwalk -Mre --dd=".*" BR6428NC_v1.15.bin

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
11280 0x2C10 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2486272 bytes
720896 0xB0000 Squashfs filesystem, big endian, version 2.0, size: 1662416 bytes, 426 inodes, blocksize: 65536 bytes, created: 2015-07-08 04:43:17

$ binwalk -Mre --dd=".*" BR6428NC_v1.16.bin

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
11280 0x2C10 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2486272 bytes
720896 0xB0000 Squashfs filesystem, big endian, version 2.0, size: 1659674 bytes, 426 inodes, blocksize: 65536 bytes, created: 2015-09-24 05:25:50

$ binwalk -Mre --dd=".*" BR6428NC_v1.17.bin

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
11280 0x2C10 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2301952 bytes
655360 0xA0000 Squashfs filesystem, big endian, version 2.0, size: 1340670 bytes, 508 inodes, blocksize: 65536 bytes, created: 2014-10-15 05:35:09
</nowiki>
</div>
</div>
</div>
</div>

<h1>Vulnerability Reports</h1>
* https://docplayer.net/65088821-Edimax-br-6478ac-mid-2015-multiple-vulnerability-write-up-reported-by-michael-winstead.html

<h1>Used Hardware</h1>
* [[Edimax N300 wireless router|Edimax, BR-6428nC, Wireless Router]]

<h1>References</h1>
* https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wireless_routers_n300/br-6428nc
* https://www.edimax.com/edimax/download/download/data/edimax/global/download/product/wireless_routers/wireless_routers_n300/br-6428nc/

[[Category:Documentation]]

Examination of Edimax home devices - Revision history

JPDoe: Minor: Bug fixes. Finalization before returning the equipment.

JPDoe at 12:07, 18 May 2020

JPDoe at 12:07, 18 May 2020

JPDoe at 12:04, 18 May 2020

JPDoe: Middle Update: Improved Code Injection Section

JPDoe: Major Update: UART, Buffer Overflow, Code Injection

JPDoe: Major Update: Introduction, Overview, Web Interface, Web Server, Firmware Extraction

JPDoe: Initial submit