Ftp

An exposed backup gives up a reused password, and the box’s own wireless hardware provides the route to root. Anonymous FTP → backup extraction → credential reuse (SSH) → local wireless enumeration → WPS PIN attack (reaver) → root via local escalation.