I read this excellent article about vulnerability research into a DLINK wireless router. The researcher explains clearly the coding mistake that leads to the vulnerability. He obviously reverse-engineered a binary running on the device but skips a step in how he acquired the code:
The login action is performed via the URI /apply_sec.cgi. A quick search reveals that the apply_sec.cgi code is located at function do_ssc (0x40a210) in the /www/cgi/ssi binary.
What are some methods for acquiring these binaries (that is, the firmware)? I've been learning how to use Ghidra. Looking at vulnerable binaries from routers would be a good learning exercise.