Goal

Bypass firmware signature check that prevents tplink deco devices from loading user-provided firmware (i.e. openwrt) in a way that doesn't require soldering on a serial console

Methods

Bootloader recovery httpd firmware upgrade stack buffer overflow

• Deco S4 v2
• Deco S4R(EU) v2
• Deco S4 v2.6
• Deco M4R v1
• Deco M4R v2
• Deco M4R v2.6
• Deco P9 v1.80
• Deco P9 v2.0
• Possibly other older MIPS firmwares

Userspace webpage firmware upgrade stack buffer overflow

• Deco S4 v2
• Deco X20 v3
• Deco M4R v3
• Deco M9+ v1
• Deco M9+ v2

Undocumented 3rd party firmware format

• Deco S4 v2

Small RSA keys

• Unknown, probably many deco device types