Like every other website on the planet, SmallNetBuilder uses cookies. Our cookies track login status, but we only allow admins to log in anyway, so those don't apply to you. Any other cookies you pick up during your visit come from advertisers, which we don't control.
If you continue to use the site, you agree to tolerate our use of cookies. Thank you!

Router Charts

Click for Router Charts

Router Ranker

Click for Router Ranker

NAS Charts

Click for NAS Charts

NAS Ranker

Click for NAS Ranker

More Tools

Click for More Tools

NAS Reviews

Under the Covers

Figure 17 shows the main board of the M3800. A key difference between the M3800 and discontinued N3200 is the upgrade of the CPU to better handle the A/V decoding and to provide better NAS performance. The CPU is hidden under the heatsink. But it's documented to be an AMD LX800, instead of the N3200's Freescale 8347 @ 400Mhz.

Main Board
Click to enlarge image

Figure 17: M3800 Main Board

The SATA controller you can see in the image is a Silicon Image SiI3114 - PCI to 4 Port SATA150 and the two gigabit Ethernet ports are from the Intel 82541p1 chips. Both the N3200 and M3800 have only 256 MB of RAM, which is pretty stingy by current NAS standards and considering the high performance processor.

Figure 16 shows the PCI board that provides the M3800's A/V output features.

PCI Board
Click to enlarge image

Figure 16: PCI Board for A/V Support

The main support chip is hidden under a heatsink so I couldn't identify it. But with a little poking around after I gained root access (more shortly), I found a reference to a string "em8xxxfb" which likely refers to a Sigma Designs SMB8630 series chipset.

Like most other NASes, the M3800 runs Linux internally. But to dig a bit deeper, I wanted to see if I could get direct access to the operating system so I could poke around. Typically the way I do this is to look for flaws in the web-based user interface where I can inject my own commands.

After poking around for a while, I zeroed in on the user WebDisk (described here). Long story short, I was able to set up a special argument-modifying web proxy and bypass the javascript validation used by the WebDisk search feature. Due to the serious nature of this security hole, which didn't require having admin access, I reported the bug to Thecus, who promptly fixed it and posted v1.00.03 firmware and v1.00.03a patch file to fix it.

While poking around after installing the new firmware and patch I found another but less serious hole. This one requires an administrator's password so a normal user would not be able to exploit it.

Basically, I went to the Notification menu and filled in normal, proper email information. But I then set up an argument-modifying HTTP proxy to intercept the cgi call and change the notification email address to be something like test`reboot`test@something.com. The result was a reboot of the M3800, which shows that the address was passed directly to a command shell. Obviously, the reboot command could have been something more damaging.

As I mentioned, this hole is only available to an administrator, so there's not a whole lot of danger. Apparently, Thecus agrees, since they have rolled the fix into an upcoming firmware release, which has no set release schedule at this point.

So what did I find with my root access? Pretty much what I expected. Apache was being used as the web server and Samba for SMB support. The iTunes server was Firefly and the Linux kernel was version 2.6.23. I also noticed that one of the startup scripts referenced the dropbear ssh daemon. But it was commented out and the deamon itself had been removed from the system.

But since this is a standard x86-based Linux box, with a bit more time, I could have easily added the daemon back in and updated the boot script to get a command line. Since there are a lot of GPL-licensed components on the box, Thecus is required to provide source code. A quick search of their web site does list source for the M3800.

Closing Thoughts

The M3800 has many features and the performance is top-rate. I enjoyed the iTunes and UPnP AV features and appreciated the Linux and Mac support. The web user interface was a bit boring. But that's not a big concern to me since after you set the box up, you won't be using it much.

But what about it as a HD video player? In short, the A/V output features just don't cut it. I expect more polish, support for a lot more formats, better handling of metadata and a flashier interface.

If you have a compatible video library and don't mind spending an extra $150 - $200, you might go for it. Otherwise just get an N3200 Pro and pocket the difference.

More NAS

Wi-Fi System Tools
Check out our Wi-Fi System Charts, Ranker and Finder!

Support Us!

If you like what we do and want to thank us, just buy something on Amazon. We'll get a small commission on anything you buy. Thanks!

Over In The Forums

So I just picked this new RT-AX88U yesterday, I just set it up today, so far no issues other then the questions I will ask.1. I tried to do a clean in...
Hi all,I have a RT-AC86U running Merlin version 384.9. The router is connected at the VDSL modem, WAN-LAN port. The router and the modem have IP on di...
Hi to @ll,I was searching for an actualized setup for the RT-AC68U in the forum and internet in general.I donĀ“t know if it possible to have a complete...
Hello,I have a Netgear Nighthawk R7000P which I accidentally Bricked when I unplugged it while it was on. It is now in a boot loop, and TFTP doesn't w...
Hi All,Noticed that my IP address changed last night just after 1am (The times on the log are 1hr+ as the router has already applied DST)Asus RT-AC86U...

Don't Miss These

  • 1
  • 2
  • 3