Prepared For: Guangzhou Robustel Co. Ltd

Date of Report: 15th July, 2026

Author Name: Josh Sewell

The information, representations, statements, opinions, and proposals contained in this document are provided in good faith and are believed to be accurate at the time of writing. However, they are not intended to be, and should not be construed as, legally or contractually binding unless and until incorporated into a separate written agreement executed by the relevant parties.

Any future agreement arising from discussions in connection with this document will be subject to further negotiation and agreed terms and conditions.

Unless otherwise governed by a written confidentiality agreement between the parties, this document contains confidential information belonging to the disclosing party and the recipient. Such information must not be disclosed to any third party without prior written consent from the disclosing party.

Security testing services were conducted for Guangzhou Robustel Co. Ltd in line with the scope of work outlined in this report. The engagement included the following activities:

In order to reduce the time required to perform security testing, sample testing is often conducted where appropriate. For example, if a range of workstations are created from a single image and have (provably) identical (or near identical) configurations, then a sample may be tested as opposed to the entire range. This ‘sample testing’ could also be applied to servers, however it is significantly less likely that the servers will have identical configurations.

It was decided that sample testing would not be appropriate in this assessment, given the relatively small and varied scope submitted.

The following assessment caveats were adhered to:

This security assessment report is divided into the following sections:

This section provides a high-level overview of the assessment results, enabling readers to quickly understand the overall outcome. It summarises the key findings, including a brief description and associated risk level. Where appropriate, commentary is included to explain the significance of the findings, their potential business impact, and recommended remediation actions.

This section forms the main body of the report and contains detailed information for each identified finding. Vulnerabilities are described with supporting evidence where applicable (such as screenshots or tool output), risk ratings, remediation guidance, relevant references, and affected systems. Findings identified through both automated and manual testing techniques are included. Informational observations or non-critical issues may also be documented where relevant.

Supporting material that is too extensive or supplementary for inclusion in the main body of the report is provided in this section. This may include extended tool output, enumerated data, configuration extracts, or other collected evidence. Where relevant, references to this material are provided within the detailed findings.

This section contains background information relevant to the report but not directly related to specific findings. Examples may include details of the risk rating methodology, testing approach, scope considerations, limitations, or descriptions of tools and techniques used during the assessment.

The following assessment scope was submitted by the client and confirmed during the initial briefing with the associated consultant(s). Authorisation to perform security testing on the supplied scope has been supplied and documented in the required authorisation form(s) signed by the client.

All testing was conducted within the limits of the scope supplied above, mitigating the risk of any breach of the ‘Computer Misuse Act 1990’. The client did not provide any additional hosts within the supplied ranges that should be specifically excluded from the scan.

This section includes a high-level paragraph summarising the overall results of the assessment, allowing readers with little time to gain an understanding of the ‘bottom line’. The key findings with a short description and level of risk are included also. The consultant’s comments further explain the results of each test, their business impact and the recommended remediation steps specific to the client.

This build review covers a Linux-based router utilising a custom kernel and focuses on the overallsecurity posture. During the assessment, no vulnerabilities of a critical or high-severity werediscovered. The assessment identified a small number of areas with recommended areas forimprovement. For example, the presence of an outdated OpenSSH version, which has already beenmitigated through the application of a patch addressing a recently published vulnerability, and the useof a self-signed certificate, which may reduce trust assurance. Concerns were also noted around therouter's login controls, where a weakly configured password policy and a high allowance for failed loginattempts increase the risk of unauthorised access, particularly when combined with the use of publiclyknown default administrative credentials that are physically labelled on the device, albeit with arequirement to change the password on first use.

The target system is a Linux-based router platform running a custom-compiled Linux kernel. As anetwork-facing device, the router exposes multiple services that are critical to its operational role andtherefore require a strong baseline security configuration. The review focused on the versions andconfiguration of key components, including secure remote access services, web services,authentication controls, and cryptographic trust mechanisms. The router is running OpenSSH version8.8, which is considered outdated. However, it was confirmed that the firmware under test has beenpatched to address CVE-2024-6387, mitigating the known remote code execution risk associated withthat vulnerability. While the applied patch reduces immediate exposure, continued use of an older OpenSSH release may still carry residual risk if additional vulnerabilities are disclosed. Maintainingalignment with vendor-supported or current stable versions is recommended to ensure ongoingsecurity coverage and simplified patch management.

The device is configured with a self-signed TLS certificate for its management interface. While this doesprovide encryption in transit, it does not offer external trust validation and can lead to users bypassingbrowser warnings, increasing the risk of man-in-the-middle attacks in hostile network environments. Inproduction deployments, the use of certificates issued by a trusted internal or public certificateauthority would provide stronger assurance of server identity and improve overall security hygiene.This finding has been classified as Informational due to the presence of compensating controls.

A number of weaknesses were identified in the authentication and access control configuration of therouter's web-based login interface. Although the minimum password length is set to eight charactersand complexity rules require three of four character classes, these controls are weakened by thelockout policy, which permits ten consecutive failed authentication attempts before enforcement. Thisthreshold significantly increases the feasibility of brute-force or credential-stuffing attacks, particularlyagainst an internet-accessible management interface. Reducing the allowed number of failed attemptsand introducing progressive back-off or temporary account suspension would materially improveresistance to automated attacks.

Additionally, the router is shipped with a default administrative username and password ofadmin/admin, which is publicly known and physically printed on the device casing. While the platformenforces a password change upon first login, the presence of well-known default credentials creates awindow of exposure during initial deployment and increases risk in scenarios involving physical accessor poor provisioning practices.

Information associated with the report (but not directly with the specific results of the assessment) will be placed in this section. For example, explanations of the vulnerability risk rating system, testing methodology and descriptions of testing tools may be found here.

This report was written by the following consultant. Any questions regarding the report’s contents can be sent to the author directly. This includes any questions regarding the exploitation, remediation and/or business impact of any vulnerability described above.

Author: Josh Sewell