Back in high school I got ahold of a Verizon MiFi 5510L mobile hotspot. It came in handy for my hour-long bus ride home from school. One day I ran the updater package to update the firmware and discovered it opened a serial port on the device, which exposed a user-level shell. Poked around and it turns out there was a world-writable script executed by root on reboot, so an edit to that file to change the root password opened the door.
I had a few people ask me about it on reddit back then and this is what I would DM them:
To get root on the Mifi, download this DUU. Plug it in on charge mode, run the DUU and have it verify the device. The mifi will reboot into debug mode. Now unplug the mifi, force quit the DUU, plug it back in and check device manager for the COM port.
Open PuTTY and connect to that com port, login with guest (does not have a password by default but you might want to set one), and run these commands: (change TestPassword to whatever you want)
cat /opt/nvtl/bin/nvtl_radvd.sh > /tmp/nvtl_radvd.sh
sed -i '85 a echo -e "TestPassword\\nTestPassword" | passwd root' /tmp/nvtl_radvd.sh
cat /tmp/nvtl_radvd.sh > /opt/nvtl/bin/nvtl_radvd.sh
Now turn it off and back on, it should stay in debug mode, connect to it in PuTTY and login with root and the new password. Keep that line in /opt/nvtl/bin/nvtl_radvd.sh because sometimes it will reset the password and you want it to change to yours every time it gets rebooted.
That hotspot is long gone, but it kickstarted my interest in exploiting and repurposing embedded devices. Feel free to try this if you happen to have a 5510L sitting in a drawer somewhere. I doubt it’ll be patched at this point considering the latest firmware was released in 2014.