Materials and references for my DEF CON 33 talk on exploiting vulnerabilities in Tuoshi and Kuwfi 5G & LTE Routers.

Covers CVE discoveries, exploitation demos, and lessons learned from vendor analysis.

1. Whoami
2. Related Work
3. Tuoshi Devices
4. Kuwfi Devices
5. Conclusions

• Related Work: DEF CON 27 - g richter - Reverse-Engineering 4g Hotspots for Fun Bugs and Net Financial Loss

• References:

  • Bootloader Unlock CVE-2022-38694
  • @sengkyaut Articles

Tuoshi (Dionlink): NR500-EA, LT15D, LT21B

Kuwfi: GC111, AC900, CPF908, 5G01-X55