TP-Link TL-841N teardown finds hardcoded credentials that survive a reset

A hardware-hacking hobbyist bought a bottom-of-the-line TP-Link TL-841N(EU) router for $10 from a stranger on Facebook Marketplace, intending to practice the full pipeline of pulling apart an IoT device: finding a debug interface, getting a root shell, extracting the firmware two different ways, and poking through the filesystem for security issues. Opening the case, the UART debug pins were clearly labeled except that the flash chip, a GD25Q64CSIG, sat on the underside of the board. The author notes that on unlabeled boards a multimeter can find the pins instead, since the TX pin fluctuates during boot while GND stays at 0V. A USB-to-UART adapter was wired up (red 5V, black GND, green TX, white RX) and connected at the common 115200 baud rate with picocom; the router dropped straight into a root shell with no further effort. Plugging a computer into the router's LAN port also gave normal access to its admin console.

The first firmware dump used the router's own UART connection and TFTP. After listing the flash layout at /proc/mtd, the author installed a TFTP server on a Mac and pulled each partition off with cat and tftp, deleting the local copy after each transfer because the router's only free storage was its RAM-backed /var partition, just under 6.4 MiB. To get a more capable shell for this work, a precompiled MIPS BusyBox binary was uploaded over the router's own TFTP client, following advice quoted from another writeup that this makes the job much easier.

The second method extracted the flash chip's contents directly with a CH341A programmer, described in the post as a 'poor man's flash extraction tool.' Before clipping on, the author checked that the flash chip ran at 3.3V, since some chips run at 1.8V and would need a voltage adapter to avoid damage, and made sure the programmer's marked pin lined up with pin 1 of the chip. Running flashrom produced a single full image, modem.bin, which was then carved with dd into the same partitions seen on the router: a 128 KiB mtd0 holding a customised, Ralink-modified U-Boot 1.1.3 (confirmed by the string "Ralink UBoot Version" found inside the neighbouring kernel partition), the Linux kernel at mtd1, a 6.6 MiB SquashFS root filesystem at mtd2, and four 64 KiB partitions for config, romfile, rom and radio data, filling out an 8 MiB flash chip in total.

Automatic extraction with binwalk pulled a correctly decoded kernel image out of the full dump, but its squashfs extraction step failed on macOS, so the author fell back to manually carving out the mtd2 partition and running unsquashfs on it by hand to explore the root filesystem. The post, the first in a series, ends by teasing what that exploration turned up: various plaintext, hardcoded credentials left behind by the router's previous owner, with one of them persisting even after a full factory reset. The provided text breaks off before describing what those credentials actually are or unlock.

Key facts

A $10 secondhand TP-Link TL-841N(EU) router, bought off Facebook Marketplace, was rooted purely to practice end-to-end IoT hardware hacking.
Connecting to the router's UART pins at 115200 baud with picocom dropped the author straight into a root shell with no additional exploitation needed.
Firmware was dumped two ways: partition by partition over UART and TFTP, and as a single image via a CH341A programmer clipped onto the board's flash chip.
The 8 MiB flash was mapped into seven partitions: a 128 KiB customised Ralink U-Boot 1.1.3, a Linux kernel, a 6.6 MiB SquashFS root filesystem, and four 64 KiB partitions for config, romfile, rom and radio data.
Exploring the unsquashed filesystem turned up plaintext, hardcoded credentials from the router's previous owner, one of which survives a full factory reset.

Why it matters

The post is a concrete demonstration that a $10 secondhand consumer router can be fully rooted and its firmware extracted with cheap, widely available tools, a UART adapter and a CH341A programmer, in an evening. It also surfaces a specific, uncomfortable finding along the way: hardcoded credentials belonging to the device's previous owner were still sitting in plaintext on the flash, and at least one of them was not cleared by the router's own factory reset function, meaning a standard reset does not guarantee a clean slate before resale.

Who it affects

Anyone buying or selling a used TP-Link TL-841N(EU), and more broadly anyone reselling or discarding consumer routers without independently wiping the flash rather than trusting the device's built-in reset. It is also a direct how-to reference for hardware-hacking hobbyists and security researchers looking to practice firmware extraction and rooting on cheap, real-world IoT hardware.

How to use it

The post is a walkthrough rather than a product, and its practical value is the process itself: identify UART pins by their labeling or with a multimeter, wire up a USB-to-UART adapter and connect at 115200 baud with picocom, then either dump partitions over the router's own TFTP client to a locally run TFTP server or pull a full image off the flash chip with a CH341A programmer and flashrom, checking the chip's voltage first. From there, dd carves the image into partitions using the offsets read from /proc/mtd, and unsquashfs unpacks the root filesystem for manual inspection.

How solid is it

This is a first-hand, step-by-step account with the exact commands and tools used at each stage, and one of its technical claims, that the router runs a customised Ralink U-Boot, is independently backed by a string the author found inside the extracted kernel partition. It is a single hobbyist's personal project rather than a peer-reviewed disclosure, and it is explicitly the first part of a series: the text available here breaks off before the author explains what the persistent hardcoded credentials actually are or what they grant access to.

Risks and caveats

The provided text cuts off mid-series, so there is no detail yet on the nature or severity of the plaintext credentials beyond the fact that one survives a factory reset. The post does not say how old the router or its firmware is, does not identify the previous owner or explain how the author determined the credentials belonged to them, and does not describe any specific filesystem vulnerabilities beyond the credential finding despite stating that hunting for them was part of the original goal. There is no indication this was reported to TP-Link or that a vendor response exists.

“one of which would survive even a full "router reset"”

— the author of the TP-Link TL-841N teardown