victorique-123/cve-2023-38829-netis-wf2409e_report对NETIS WF2409E路由器进行的一次完整硬件安全分析研究。通过对设备进行拆解分析、调试接口识别、固件提取等工作，记录了硬件分析的全过程、漏洞细节以及相应的安全建议，希望能帮助提高物联网设备的安全性。
| Category | Parameter | Description |
|---|---|---|
| Device Information | Model | Netis WF2409E |
| Type | 300Mbps Wireless N Router | |
| Power Supply | DC 9V/500mA | |
| Hardware Version | V1.8 | |
| PCB Version | PB-7189-M02G-20 | |
| Production Date | 2015-03-23 | |
| Country of Origin | China | |
| Network Identifiers | Serial Number | 2409EEU5B102714 V1.8 |
| MAC Address | W8D398DFB68 | |
| Default SSID | netis_BDFB68 | |
| Default Password | password | |
| Management Address | http://netis.cc | |
| Hardware Interfaces | WAN Port | 1 (blue RJ45) |
| LAN Ports | 4 (black RJ45, LAN1-4) | |
| Antennas | 3 external antennas | |
| Power Connector | DC input (PWR) | |
| Function Buttons | Default | Reset to factory settings |
| WPS | Protected WiFi setup |
| Checked Parameter | Status | Note |
|---|---|---|
| Power LED | Working | Steady on when powered |
| Network LEDs | Working | Blink when connected |
| WAN Port Status | Working | Normal network connection |
| LAN Port Status | Working | All 4 ports operational |
| WiFi Function | Working | Antennas intact, signal normal |
| WPS Function | Working | Button responds |
| Reset Function | Working | Default button works |
| No | Chip Model | Manufacturer | Main Function | Technical Specifications | Notes |
|---|---|---|---|---|---|
| 1 | EM63A165TS-6G | EtronTech | System Memory | - Capacity 32 Mbit - Frequency 166 MHz - Architecture SDRAM - Package TSOP-II | - Used for temporary data storage - Supports main processor computations |
| 2 | FR9886 61504 | Unknown | Power Management | - Package SOIC-8 - Integrated circuit | - DC-DC - Responsible for voltage regulation - Provides stable system power |
| 3 | RTL8196E | Realtek/RMC | Main Processor | - Architecture MIPS - SoC design - Made in Taiwan | - System's central processor - Handles main computations and management - Integrated network processing |
| 4 | MX25L3206E | Macronix | Flash Memory | - Capacity 32Mb (4MB) - Interface SPI - Package SOIC | - Stores system firmware - Retains configuration data |
| 5 | RTL8192ER | Realtek/RMC | Wireless Connectivity | - WiFi controller - Package QFN | - Processes wireless signals - Supports WiFi functions |
| Parameter | Specification |
|---|---|
| Processor Model | RealTek RTL8196E |
| Architecture | 16-bit |
| Clock Frequency | 380MHz |
| Compilation Date | 2014.09.29 |
| Parameter | Value | Hexadecimal Value |
|---|---|---|
| Chip Model | MX25L3205D | - |
| Total Capacity | 4MB | 0x400000 |
| Block Size | 64KB | 0x10000 |
| Sector Size | 4KB | 0x1000 |
| Page Size | 256B | 0x100 |
| Parameter | Description |
|---|---|
| Bootloader Type | RealTek Proprietary Bootloader |
| Kernel Load Address | 0x80500000 |
| Start Execution Address | 0x80003440 |
| Signature Search Range | 0x10000-0x170000 |
| Parameter | Value |
|---|---|
| IP Address | 192.168.0.1 |
| Subnet Mask | 255.255.255.0 |
| MAC Address | 04:8d:38:bd:fb:69 |
| Wireless Interface | wlan0 (including va0-va3, vxd) |
| Parameter | Value |
|---|---|
| Device Model | netis WF2419E_RU |
| Firmware Version | V2.5.40200 |
| Firmware Date | 2016.09.02 |
| BusyBox Version | v1.00-pre8 (2015.01.23) |
| Service Name | Status | Note |
|---|---|---|
| DHCP Server | Running | Normal |
| HTTP Server (Boa) | Running | Abnormal reboots |
| IAPP | Running | IEEE 802.11f |
| MiniIGD | Running | v1.08.1 |
| mini_upnpd | Error | File not found |
| telnetd | Error | File not found |
| ota_init.sh | Error | File not found |
It is important to note that this device likely does not use U-Boot. Key indicators:
---RealTek(RTL8196E)at 2014.09.29-19:16+0800 v1.0 [16bit](https://github.com/victorique-123/cve-2023-38829-netis-wf2409e_report/blob/master/380MHz)