I recently ripped apart my WCG200. built a serial cable for it, and had some fun. I am posting my findings here to see if anyone has any insight on getting both off and onto the device through the serial port, as it doesnt appear to have pinouts for jtag and because its a ball grid array I cant get access to pins directly. Board photos on request because of image size. Runs vxworks, unknown version, I would assume vxworks 2.1 or 2.2. Board version is 1.2b and uses the broadcom docsis 2.0 system on chip. Mini-pci wireless card, the usual broadcom suspect, an intel flash chip, and the rest of the chips are broadcom or noname ddram. Ram is 16MB, On the software side it uses a QoStek bootloader, and runs the default vxworks/broadcom cable modem software combo that most cable modem run. I have a full shell I can exploit from the serial console, and can try suggestions and post logs on request. A log of startup can be found at http://www.geocities.com/zabb65/cablemodem.txt (Garbled part is when I accidentally touched the casing of the ethernet switch and disrupted the ground, causing a segfault) HTTP interface is unexploitable as far as I can tell due to the fact that it doesnt directly execute commands throught the vxworks shell. As you might notice there is a telnet daemon that can be enabled, and it provides a shell, but I havent gotten it working yet. Another interesting tidbit is the matrix reference during the startup of the cable modem application. Hope somebody can help me, and if not, I will figure something out on my own and get a project started. (Rambling post, I know, have never been good at expressing info in a fully coherent way) Edit: Its tornado 2.2 or a vxworks 5.x distribution. Can be netbooted fairly easily, and internal pictures will be posted tomorrow. Shame that nobody is interested.