From Botnet to Silicon: The Consumer Hardware Border Is Wide Open

VertexElite Security Research — Nirmal Liyon

For years we treated routers and Bluetooth dongles as appliances. Plug them in, change the Wi-Fi password, forget they exist. That comfort is dead. The devices under your desk are now the first domino in every serious attack chain — and the companies that make them are not being held accountable.

We built VertexElite research to prove that chain, end to end, with hardware in hand and source code on the screen.

1. The router is not a router anymore

A Tenda AC1206 sitting in a Sri Lankan home or small office is not a consumer gadget. It is a Linux computer on the public edge of a network, running a web server that accepts deviceList through strcpy and hands root to anyone who asks.

CVE-2025-7544 is not a theoretical overflow. The Zerobot Mirai variant has been weaponizing it in the wild since at least late 2025. We verified the vulnerable path at instruction level in firmware 15.03.06.23: unbounded copy, saved-RA overwrite, no patch from the vendor. Add to that a production /goform/telnet endpoint that spawns telnetd on factory-default units, and the device becomes a persistent beachhead.

The national context matters. Sri Lanka's ISP CPE estate is rootable at scale through estate-default credentials. Independent researchers have reported it twice to local CERT with no response. When Mirai-class botnets own tens of thousands of these boxes, they become the enabling layer for downstream breaches — including the March 2025 Cargills Bank incident, where 1.9 TB of data walked out. We do not claim the router was the sole cause. We do claim it was the open door the thief walked through.

2. The silicon beneath the plastic

Move one layer down and the problem gets worse. Bluetooth and Wi-Fi SoCs ship with no real firmware integrity. JieLi chips — found in low-cost audio devices, earbuds, LED controllers, and a surprising number of white-label gadgets — use a universal static authentication key and CRC-16-only firmware validation. We extracted the same 16-byte key from libjl_auth.so across the ecosystem, captured pre-auth GET_TARGET_INFO leaks on real Samsung and generic devices, and mapped the RCSP attack surface device by device.

AICSemi AIC8800 is the same class of failure in a different market: USB Wi-Fi dongles, IoT cameras, SBC modules. The Linux driver writes firmware to the chip over a debug-message channel with no signature, no HMAC, no challenge-response, and an MD5 that is printed to dmesg but never checked. DBG_MEM_BLOCK_WRITE_REQ writes arbitrary memory; DBG_START_APP_REQ jumps to an arbitrary address. Any driver update, supply-chain swap, or malicious package can turn the chip into firmware the host cannot see.

This is not a bug. It is an architecture. When a chip cannot verify what it runs, the attacker owns the layer below your operating system.

3. The AI layer is the new exploit marketplace

Traditional exploit markets sold zero-days. The new market sells access to AI labor. ClawHavoc and its OpenClaw infrastructure showed how a malicious skills marketplace can package remote code execution, infostealers, and Claude Code abuse into a SaaS model for non-technical buyers. We captured VibeOps wrapping Claude Code CLI as a multi-tenant web service for Korean enterprise teams, safety guardrails disabled, WebSocket bridge enabling remote execution through a browser.

The same supply chain that ships unverified firmware now feeds data into AI systems that can act on it autonomously. The convergence is the threat: cheap pwned hardware at the edge, untrusted silicon below the OS, and agentic AI above it that moves faster than human response.

4. What we actually do

We do not chase headlines. We build reproducible evidence:

• No-root, no-jailbreak methodology. Any CERT or journalist can repeat our JieLi capture with adb and PCAPdroid.
• Build-level verification. We disassemble the actual httpd binary. We trace the actual aic_load_fw driver. If a CVE does not apply to a build, we say so — CVE-2026-11405 is absent on AC1206 15.03.06.23, and we documented exactly when the backdoor entered the shared AC6V2.0 source tree.
• Live verification over cache. Our VertexScan engine confirms whether a Shodan claim is real, phantom, or a blind spot before we publish it.
• Coordinated disclosure with teeth. We notify vendors, regulators, and CERTs first, give a 90-day window, and publish if they fail to act.

The point

The future of attacks is not a slick zero-day dropped by a nation-state. It is a pile of $5 chips and $20 routers, all running firmware nobody verified, stitched together by AI agents that never sleep. The border of your network is no longer a firewall. It is the Bluetooth chip in a worklight, the Wi-Fi dongle in a kiosk, and the router your ISP mailed you three years ago.

We are mapping that border in public. Because if we do not prove it, the next breach will be blamed on users who "should have changed their password" — while the real fault sits in silicon nobody audited.

Active tracks: VES-JL-2026-001 (JieLi), VES-AIC-2026-001 (AICSemi), VES-LK-CPE-2026-001 (Tenda/Zerobot), VES-CA-2026-001 (ClawHavoc / convergent AI supply-chain threat).

Published by VertexElite Security Research · research@vertexelite.org