Highway to Critical Heaven: Scaling Vulnerability Discovery Across Hundreds of Routers

My BSides Atlanta 2026 talk with Vipin B.: collecting and auditing firmware for hundreds of routers with our own tooling and AI agents, and the 40 critical findings that came out of it. Full slide deck embedded.

  • 2 min read

Presented at BSides Atlanta 2026 — Atlanta, GA. Co-presented with Vipin B. of vert3x.

These are the slides from our talk on Project CritHeav3n: pulling firmware for hundreds of consumer routers, auditing it at scale with a mix of our own tooling and AI agents, and checking which findings actually hold up on real hardware.

Open the slides (PDF) on vert3x.io

Navigate with ← / → (or swipe on a phone); press R to jump back to the first slide. More of our work is at vert3x.io.

What it covers#

  • Getting the firmware: open vendor FTP portals and storage buckets, plus browser agents that register accounts and download from bot-hardened support pages.
  • Post-processing: recovering decryption keys (older images, side channels, JTAG, flash dumps) and cataloging every image by product family and release date.
  • Two pipelines, side by side: the top 50 products per vendor were split between Axiom, our own unpack, points-of-interest, deep-scan and reproduce pipeline (91% of its findings were valid vulnerabilities), and a Codex audit with one orchestrator and five parallel auditors running two waves over 23 hours.
  • Case studies: a MikroTik SNMP stack overflow (CVE-2026-88464, now patched, with 44,531 MikroTik SNMP hosts publicly reachable per Censys), and a TP-Link mesh "RCE" that scored 8.8 in emulation but never reaches the daemon on a real network, because the kernel reads EtherType 0x0300 as an 802.3 length.
  • Results: 40 critical findings across MikroTik, NETGEAR, D-Link, GL.iNet, ipTIME, ASUS, Xiaomi and TP-Link, 19 of them with confirmed code execution. Command injection was the most common weakness by a wide margin.

The takeaway#

Command injection should be dead in 2026, and it still turned up in 19 of our findings. Vendors could cut most of the damage by sanitizing input, running network daemons without root (10 of 16 finding families ended in code execution), and patching a shared component across every product line that ships it, not just the model that was reported. On cost, the whole project ran on about $800 of Codex subscriptions, against roughly $10,000 at API prices.