Eufy HomeBase 2 Teardown Reaches a Root Shell on Firmware 3.4.2.2h, With the Case Open

A security researcher group going by Adepts of 0xCC got a root shell on a Eufy HomeBase 2 running firmware 3.4.2.2h, but only by desoldering its flash chip and rewriting the recovery image with the case open.

The write-up, published on September 28 and later posted to Hacker News, describes no remote exploit, lists no CVE and records no contact with Eufy or its parent company Anker.

What the 3.4.2.2h teardown found

The hub's flash is a Winbond 25Q256JWEQ. In-circuit reads failed because, the author says, "the power supplied for the read operation also activated other components on the board". The author's brother-in-law, Óscar Lestón, desoldered the chip and the group read it with a Raspberry Pi. One 64 KB block would not read, which the author attributes to damage during removal. The firmware build is dated June 5, 2026.

The serial console asks for Enter and then loops in a login.sh script unless the NVRAM variable debug_log is set. The author wrote that "the firmware did not contain anything encrypted", so the intact recovery image could be modified to skip the check and reflashed with write protection disabled. The device then booted to a root shell over UART.

Preconditions: physical access only

Both routes need the attacker to hold the hardware. The first is desoldering and reading the flash. The second is a USB-TTL adapter on the board's serial port. The author also mentions a remote debug mechanism over ARP that accepts signed commands but did not use it, because the signing key is not in the firmware.

The management Wi-Fi password is the one piece of cryptography the author examined. The SSID is "OCEAN_" plus part of the MAC address, and the password is an HMAC-SHA256 with the serial number as the key and a value read over I2C as the message. The author says the serial number is predictable because it follows a known template, but does not state whether the scheme is weak, and the I2C value is the one input the write-up does not recover.

How the 2021 HomeBase 2 flaws differed

Cisco Talos reported that HomeBase 2 firmware 2.1.6.9h had a network-reachable command injection, CVE-2021-21954, rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation required authentication, which Talos said two other bugs (TALOS-2021-1379 and TALOS-2021-1380) could bypass. Talos's timeline shows vendor disclosure on September 28, 2021, a patch on November 22 and public release on November 29.

	Talos, 2021	Adepts of 0xCC, 2026
Firmware	2.1.6.9h	3.4.2.2h
Access needed	Network, after an authentication bypass	Physical, with the case open
Outcome	Root command execution	Root shell over UART
Score or CVE	CVE-2021-21954, CVSS 9.9	None assigned

The comparison shows where the exposure moved. A remote path to root in 2021 became, on the evidence published so far, a bench job in 2026. Owners are exposed only where a stranger can handle the unit, such as a shared flat or a hub left in an unlocked cupboard.

The case for the firmware itself is weaker. The author found nothing encrypted and a recovery image that accepts modification, and Secure Boot is the control that would stop that. Epic attached a Secure Boot requirement to Easy Anti-Cheat on Linux, but the write-up does not say whether the HomeBase 2 has a verified boot chain. Related coverage includes a root exploit in OpenBSD.

The author's runtime setup lists ports 10400 to 10600, 32290 to 32392, 9000, 554 and 23 on the staged home_security binary. The write-up does not say whether any of them listen on a stock device, and the Wi-Fi and I2C drivers did not come up in the staged environment.