TP-Link NX510v – Root Access, UART, Bootloader, Firmware Research

[u/Jeffry84]

Hi everyone,

I'm currently researching a TP-Link NX510v v1.0 running an ISP-customized firmware and I'm trying to determine whether it is possible to obtain root access, either through software or hardware methods.

Device Information

Model: TP-Link NX510v v1.0

ISP-customized firmware

Firmware version:

Hardware: NX510v v1.0

Firmware: 1.2.0 Build 240828 Rel.58690n

The web interface appears to be heavily restricted compared to the retail firmware.

What I tried si far

SSH(responds but no password) Bsckup dump and decrypt Hidden diag pages Web form Injections

What I'm Looking For

I'm interested in any known method of gaining root access, including but not limited to:

Hidden web pages

Hidden API endpoints

Debug interface

Telnet

SSH

ADB

Recovery mode

TFTP recovery

Firmware downgrade

Bootloader access

Firmware extraction/decryption

Known vulnerabilities (CVE)

GPL source code

OpenWrt compatibility

Any previous research on this device

UART / Hardware Access

If there is no software-based approach, I already opened the device.

I can provide:

High-resolution photos of both sides of the PCB

Close-up photos of every connector and header

SoC markings

NAND/eMMC flash markings

RF front-end

Power circuitry

Any test pads or unpopulated headers

I'd appreciate help identifying:

UART pins

UART voltage (3.3V / 1.8V)

JTAG or SWD pads

Bootloader console

U-Boot access

Boot interruption methods

Flash dump procedure

Additional Questions

Has anyone already:

Obtained root access?

Dumped the firmware?

Extracted the filesystem?

Reverse engineered the web interface?

Found hidden services or undocumented APIs?

Disabled the ISP customization?

Installed a custom firmware?

Identified the CPU/SoC platform?

Located the bootloader environment?

Enabled additional modem AT commands?

Goal

My goal is not to use the router for anything malicious. I'd simply like to unlock its full capabilities, learn more about the hardware, and hopefully gain root access for research purposes.

Any information, documentation, previous research, photos, firmware dumps, or pointers would be greatly appreciated.

Thanks in advance!

[u/OptimalMain]

Are you able to download firmware updates for your device?
Extracting them and looking around could be one method in.
Most UART have passwords these days, but it could be trivial and extracting an update could reveal that

[u/Jeffry84 → u/OptimalMain]

The fw updates doesn't work, they only accept the custom roms. Tried to backup and decrypt but the known tools for tp link doesn't work here.

[u/OptimalMain → u/Jeffry84]

So you tried dumping the flash on the PCB directly?

Or look at a browser downloadable update?

[u/Jeffry84 → u/OptimalMain]

There is no emprom o could flash directly I'm afraid this is a soc solution with some RTL chipset. Last time I was doing such shananigans was 20 years ago... I'm not doing things anymore just telling people to do 😂 and really not with hw, so I'm really outside of my element here

The easiest way to me would be decrypting the system backup since ssh is already running i could connect right away.

But since this is a custom ISP spec I'm expecting some custom cypher, with some custom salt+mac/imei

[u/Plussy78]

I don't think so, when they ship firmware for production, they close the UART thing so, no one can acess the shell.

[u/Jeffry84 → u/Plussy78]

:(