Hitron CGNM-2250
The Hitron CGNM-2250 is a DOCSIS 3.0 modem that was used with Shaw. We used it sometime between 2017 through to 2023.
Hardware
More info on Wireless Cat:
The Hitron CGNM uses a Intel Atom CPU with 512MB of DDR3 memory. There is a 128MB NAND flash module.
Hacking
There are 2 4-pin headers on the main board. Both are 3.3v serial connectors at 115200 baud. The one closest to the CPU seems to be a secondary serial connector with only brief messages about the kernel extracting and booting on power up. The other serial header seems to be the primary serial device since there are POST messages when the system boots.
The default Shaw firmware seems to be locked down. There are no messages sent to the serial console using the default boot option.
Root access
The only way to get root access on the device is to hold down the button nearest the serial connector (not the reset button) when powering on the device. This makes the system boot Linux using partition 6 as root. I tried to hold down the enter key and space key during the booting process but it did not allow changing the boot option. Holding down the enter key during the booting process does result in the BIOS printing "please input your password" but nothing else.
Once you're on the router as root, you can change its default IP address. This mode seems to always bring up the device as 192.168.0.245, but changing this using the usual ip command works fine. Once you have networking working, you can mount NFS and telnet onto the system (login as 'root' with the password 'root').
Exploring the partitions, we see that there are 13 partitions in mmcblk0. The first partition seems to contain the BIOS for the Intel Atom as it contains binaries that are used by the BIOS as it boots. There's a strong presence of 'IntelCE' and 'intelcefdk' which is from Intel Consumer Electronics / Firmware Development Kit (FDK). Interestingly, the first result from looking this up is the 20GB Intel leak back in 2020.
The router.cfg file contains all the options set by the Hitron web interface. There are 4 accounts (1 of which is an admin) as defined by this file:
um_auth_account_name admin mso
um_auth_account_password admin $1$Qw/d/uIf$lkYLZEhpxY46CQPYpUxqB1
um_auth_account_enable admin true
um_auth_account_name user1 cusadmin
um_auth_account_password user1 $1$Qw/d/uIf$pcaWzKv6eY1lD4txqoQKq1
um_auth_account_enable user1 true
um_auth_account_name user2 comadmin
um_auth_account_password user2 $1$Qw/d/uIf$xfah7wBUOSdTayBZmDtMs/
um_auth_account_enable user2 false
um_auth_account_name user3 admin
um_auth_account_password user3 $1$Qw/d/uIf$QoCnlC1SkZRyUcdSMKvKF.
um_auth_account_enable user3 false
You typically login as cusadmin. That's typically set to 'password' out of the box. The mso account is the only admin account. The password is 'msopassword' but is locked out by default.
I tried to change router.cfg but it seemed to revert to factory settings on the next reboot. There's something checking the file somewhere which I've yet to figure out.