Prolink Router: Ten Ways to Get Root, Zero Authentication Required

Ten ways to get root on a single router—and none needs a password. 🔐 Researcher Daniel Lim found 10 command-injection flaws across 10 CGI scripts in Prolink's PRC2402M. The login page itself passed input straight to shell. One "password check" compared your input to an empty string's hash. The vendor acknowledged, promised fixes, then admitted a bypass existed. Real patches only landed later. The disturbing part: none of this needs much skill. An attacker just types shell metacharacters into a browser. And once they're root, they can watch traffic, redirect DNS, or pivot into your network. Any device on firmware 20190909 is a live wire. Is your router quietly being this vulnerable? 🔍

Here's a fun thought experiment for your Thursday afternoon: how many different ways can one unremarkable router let a complete stranger take total control of it, no password needed?

According to researcher Daniel Lim, the answer for Prolink's PRC2402M is ten. And honestly, they're not even creative about it.

Let Me Count the Ways

We could spend a while unpacking all ten CVEs, but let's hit the highlights of what's basically a masterclass in how not to write firmware.

There's CVE-2021-35401, where the login page—yes, the login page—passes your input straight into popen(). That's the C function that, spoiler alert, executes shell commands. No sanitization. No authentication. Just "here's your keystrokes, now they're root's keystrokes."

CVE-2021-35406 is a personal favorite. The password "authentication" checks whether your input's MD5 hash matches the hash of an empty string. That means entering nothing—or, apparently, whatever an attacker wants—beats the "security." And while we're at it, the IP address field is also handed directly to system(). Defense in depth? More like defense in name only.

Then there's CVE-2021-35407 and CVE-2021-35400, both burrowed into mesh.cgi. One's triggered by page=upgrade, the other by page=extender, but the story's identical: take the key parameter, jam it into popen(), profit.

QoS, the quality-of-service feature? CVE-2021-35408 and CVE-2021-35406 say hello from qos.cgi. Night-light scheduling (nightled.cgi)? CVE-2021-35409 found it. Live API, app login, touchlist sync—CVE-2021-35402, -35404, and -35403 wrap up the sweep of every corner of this firmware.

Ten CVEs, ten different CGI scripts, one recurring theme: nobody at the vendor checked the input before handing it to the operating system.

The Punchline

Here's the part that would be comical if it weren't so emblematic. When Lim reported these in June 2021, Prolink "acknowledged" the issues. It promised patches. Then, per Lim's findings, the vendor admitted a bypass existed. The "fix" didn't fix. Actual patches only landed around June 13, 2021.

So the timeline reads: vendor says "we got it," researcher proves "no you didn't," vendor patches for real. The affected firmware is version 20190909—devices running it remain a live wire on any network they're plugged into.

And if you're tempted to think this is yesterday's news, recall how current the same patterns remain. Take the Enphase IQ Gateway teardown from August: a researcher chained a command injection in the authentication handler with an SSH config override and a path traversal in the Ruby backend to reach root—same song, strangely familiar chorus. Or consider Motorola's MR2600, where in July an attacker just flipped the authentication logic during firmware upload and got an unauthenticated remote code execution for free. Same scripts, different vendors, new year.

The pattern is the product. Squeeze a router into the cheapest bill of materials, skip the input validation, and ship it. The economics of "good enough" security in IoT are exactly what these ten CVEs describe: nobody doing the boring work until a stranger demonstrates exploitability from across the internet.

The Part We Should All Remember

None of this requires much skill. We're not talking nation-state zero-days smuggled in through obscure crypto. We're talking webforms not checking their inputs. The most striking thing about this whole saga is that an attacker essentially gets root on these routers by typing into a browser like a normal user—just with a few shell metacharacters thrown in.

And once you own the router, you don't need a clever exploit anymore. You're root. You can watch traffic, redirect DNS, pivot laterally, or simply brick the thing to make a point. Your home or office router isn't just a box that moves packets—it's the front door, and in this case, the lock was never installed.

Prolink eventually shipped fixes for 20190909 builds. But for anyone running a PRC2402M: check your firmware, check it now, and maybe don't trust a device whose login page was granting root to an empty password. That's not paranoia. That's just reading the disclosures.