Realtek Ameba-family SoCs (RTL8710, RTL8720, RTL8730) are the cheapest commodity Wi-Fi microcontroller you can put in a product and still call it "connected." Which is exactly why they show up in ~40% of budget IoT boot logs BootIntel sees. The Ameba SDK is verbose during boot, and vendors rarely trim it.
What BootIntel detects on Realtek Ameba
- ROM + preloader version stamped at startup, matched against the Realtek advisory feed for known ROM bugs and downgrade paths.
- Secure-boot config bit + JTAG-enable bit from the eFuse summary echoed during ROM stage. Missing secure-boot = anyone can flash arbitrary firmware via UART download mode.
- AT-command interface auto-started on UART. Ameba SDK ships this on by default; production firmware should disable it. Detection surfaces the interface prompt and the command set version.
- Factory / calibration partition exposure. Boot-time partition table echoes the flash layout, which reveals whether MAC + Wi-Fi calibration + provisioning tokens sit in accessible flash.
- OTA endpoint / MQTT credentials in plaintext during first-boot / provisioning replay. Common on vendor forks that reuse the Ameba OTA reference implementation without adding TLS pinning.
What a real Ameba boot log looks like
ROM:[V0.5]
Realtek Ameba SDK v6.3
Cert: OFF Secure Boot: OFF JTAG: ON
Image1: 0x08004020, len 0x3B408
Load Image2 0x10004020 [OK]
== RTL8710BX ==
AT+ ready
The first line reveals the ROM revision. Line 3 exposes three critical boot-security defaults. Line 6 confirms the SoC family. "AT+ ready" on line 7 means the AT-command interface is live — game over for anyone with 3.3V UART access.
Common Ameba findings BootIntel surfaces
- Secure Boot: OFF on production firmware
- JTAG: ON on production firmware
- AT-command interface exposed on UART
- Vendor OTA endpoint over plain HTTP (no TLS)
- Wi-Fi credentials stored in unencrypted NVS
Want to try it? Grab a UART capture from any Ameba-based smart plug and paste it into the fingerprint tool for a fast, client-side sanity check, then run the full server-side analysis for CVE matching.