Network access and listeners

Stock network services

S24 initializes Amlogic Wi-Fi. S40/S41 start network configuration, wpa_supplicant on wlan0, and dhcpcd. dnsmasq listens only on loopback port 53 in the captured system. NTP uses public pool servers. Bluetooth runs separately through hciattach and BlueZ.

Provisioning writes network configuration into the overlay-backed /etc; see session state.

Observed listeners

Bind	Port	Process	Purpose/status
0.0.0.0 / ::	22/tcp	dropbearmulti	Third-party root SSH
0.0.0.0	80/tcp	voice-agent -mode=app	LAPI command server
0.0.0.0	8081/tcp	voice-agent -mode=app	Spotify ZeroConf service
0.0.0.0	20101/tcp	stereoctl	Stereo-pair control
0.0.0.0	5353/udp	voice-agent	mDNS/discovery
loopback only	53/tcp+udp	dnsmasq	Local DNS

Ports 80, 8081, 20101, and 5353 are stock-service listeners, not part of the SSH package. Their LAN exposure should be considered before connecting the Mini to an untrusted network. No exploit or mutation testing was performed.

LAPI on port 80

voice-agent:0x13c8a0 dispatches URL/query commands without checking an Authorization header. GET /info is always available and returns serial, device ID, firmware version, and Wi-Fi/Bluetooth MAC addresses; values are redacted here. The remaining factory commands are gated by the agent's user-mode flag and returned 404 command not found on the provisioned unit.

Recovered route set:

Category	Routes
Information/audio phrase	/info, /create_text_phrase
Audio I/O	/audio_playback, /audio_record, /audio_record_raw, /audio_record_vqe, /audio_loopback, /audio_set_volume
Bandwidth	/bandwidth_download, /bandwidth_upload
Buttons/LEDs/sensors	/button_check, /rgb_control, /lcd_test, /light_sensor, /temp_sensor, /humidity_sensor, /play
Bluetooth/smart home/Zigbee	/bt_control, /smah_invoke, /smah_state, /zb_control, /zb_info, /zb_scan, /zb_test, /zb_mgmt_lqi
Device administration	/crash, /reboot, /set_serial, /set_user_mode, /set_api_url, /wifi_connect

These are not harmless read-only endpoints. In factory mode the same unauthenticated server can capture audio, change volume, write serial/API settings, connect Wi-Fi, crash, and reboot. Do not invoke them on the research unit. Port 80 binds all interfaces, so factory/test mode must be treated as a trust-boundary change, not just a diagnostic feature.

Port 8081 belongs to the embedded Spotify ZeroConf implementation (Started ZeroConf service on port …), not LAPI. UDP 5353 carries its discovery plus Avahi neighbor discovery used by stereo.

Third-party Dropbear package

The live-only supervisor launches:

dropbearmulti dropbear -F \
  -r /etc/capsula-root/hostkey \
  -l wlan0 -p 22 -P /run/capsula-root/dropbear.pid

Properties established from the live scripts/processes:

• listens specifically on wlan0, TCP/IPv4 and IPv6 port 22;
• runs in the foreground under a supervisor;
• uses a persistent host key in the overlay;
• requires the root account to have a SHA-512 ($6$) password hash;
• can be disabled by /data/capsula-root.disabled;
• provides SFTP through /usr/lib/capsula-root/sftp-server and supports SCP through the shell tools.

The password itself is intentionally excluded from this repository.

Entware

The package includes an optional Entware installer under /data/entware, bind-mounted at /opt only when enabled and validated. It deliberately does not run Entware's rc.unslung or replace stock accounts. SSH starts even if the Entware mount fails.

Entware is not required for the root shell, SFTP, or acquisition. It is also not stock VK functionality.

Acquisition guidance

Use read-only SSH commands and stream files off-device. Avoid starting pactl without the correct runtime environment: the captured attempt returned Connection refused even though PulseAudio was running, demonstrating that client context matters.

For evidence collection, record netstat -lntup, full process command lines, and USB configfs separately; a process list truncated to 15 characters can hide important arguments.