On August 2, 2026, a researcher bought a $10 TP‑Link TL‑841N router from a Facebook Marketplace seller and began a hardware hacking investigation.

The investigation involved gaining serial console access via the router’s UART pins, dumping firmware images using a TFTP server and a CH341A flash programmer, and carving the firmware into separate partitions for analysis.

The UART connection was established by soldering a USB‑to‑UART adapter to the board’s ground, transmit, and receive pins, then using a terminal program to obtain a root shell. Firmware partitions were dumped by reading from /dev/mtd* on the router, transferring the files via TFTP, and deleting each temporary file after transfer. An alternative on‑chip extraction was performed with a CH341A programmer and flashrom, producing a complete modem.bin dump. The dump was split into six sectors corresponding to U‑Boot, kernel, root filesystem, configuration, ROM files and radio data, using dd commands and memory addresses obtained from the router’s /proc/mtd listing.

Analysis of the configuration partition revealed a hard‑coded WPS password printed on the device, and additional hard‑coded PPPoe credentials that remained after a factory reset. The default administrative account was found to be “admin” with password “admin”; an unsalted shadow hash was extracted and cracked with a wordlist, revealing the password “1234”.

The researcher noted that persistent credentials survive a factory reset, indicating a privacy limitation of the device, and suggested that further firmware examination could uncover additional vulnerabilities.