Also, the web server ( /bin/webs ) has a CGI endpoint: /cgi-bin/fw_dump.cgi . No authentication required. Requesting it returns the full kernel memory map. Not flash—actual running kernel memory. You can scrape sensitive data like PPPoE passwords from it.
The router will take 2–4 minutes to: