SBOM and component lists
MiWire publishes, for every firmware release, a machine-readable software bill of materials (SBOM) and two companion lists. They are linked from the page of each release on Firmware releases and can be downloaded from this site at a stable address:
https://documentation.miwire.net/firmware/releases/<version>/sbom.cdx.jsonhttps://documentation.miwire.net/firmware/releases/<version>/manifest.txthttps://documentation.miwire.net/firmware/releases/<version>/boot-services.txtThey are produced by the same build that produces the firmware image, so they describe exactly what is in that image.
The three files
Section titled “The three files”sbom.cdx.json: the software bill of materials
Section titled “sbom.cdx.json: the software bill of materials”A CycloneDX 1.4 document in JSON. It lists every software package installed in the firmware image, including the Linux kernel and MiWire’s own software, with for each component:
nameandversion,licenses: the licence(s) the component is distributed under (SPDX identifiers where they exist),cpe, where the upstream project provides one, so the component can be matched against vulnerability databases,type: operating system, library, application, and so on.
Any CycloneDX-capable tool can read the file. The SBOM covers the router firmware image. It names MiWire’s own packages with the licence “Proprietary”.
manifest.txt: installed packages
Section titled “manifest.txt: installed packages”A plain-text list, one package per line, in the form package - version. It is the same information as the SBOM’s names and versions, in the form the OpenWrt package manager uses, for people who prefer to read or diff a text file.
boot-services.txt: what runs at boot
Section titled “boot-services.txt: what runs at boot”Two sections:
- Services enabled at boot: the system services (init scripts) that start when the unit boots, in start order.
- Feature switches and their shipped default: the MiWire features that can be on or off (for example the security event log, the SNMP agent, the statistics upload) with the state they have on a unit as delivered.
Together with the release date on the release page, these three files give the name, version, release date and factory-boot status of the software installed on the device (LAC-BCOP-1 GR-02) and the name, version and licence of each open-source component (GR-03).
Release date. Nothing on the unit is installed or updated separately from the firmware image, so the release date of every component listed is the release date of the firmware version it ships in, as shown on the release page. Package version strings are the upstream project’s own.
What each service does
Section titled “What each service does”boot-services.txt names the services by their init-script name. This table says what each one is for and whether it runs on a unit as delivered. Which of them listen on the network, and on which port, is on Services and ports.
Operating system and platform
Section titled “Operating system and platform”| Service | At boot | Purpose |
|---|---|---|
boot, system, sysctl, fstab, done |
on | OpenWrt start-up: file systems, hostname and time zone, kernel settings, end-of-boot marker |
sysfixtime, sysntpd |
on | Sets the clock from the newest file at boot, then keeps it synchronised with the configured time servers (the unit is an NTP client only) |
urngd, urandom_seed |
on | Random-number seeding |
log |
on | System log (in memory) |
rpcd, ucitrack |
on | Configuration back-end used by the web interface |
openssl |
on | Cryptography library initialisation |
cron |
on | Scheduler for the periodic jobs listed below |
dbus |
on | Message bus used by the cellular modem tooling |
usbmode, modem_switch |
on | Puts the cellular module into its operating mode at boot |
gpio, gpio_switch, pwm |
on | Board inputs and outputs (buttons, fan, indicator light) |
tweaks, packet_steering |
on | Distributes network interrupt handling across the processor cores |
bootcount |
on | Clears the bootloader’s boot counter once the system is up |
ubihealthd |
on | Flash storage health maintenance |
sysstat, vnstat |
on | System and network traffic counters shown on the status pages |
Network
Section titled “Network”| Service | At boot | Purpose |
|---|---|---|
network |
on | Network interfaces (LAN, Wi-Fi, cellular) |
firewall |
on | Packet filter: no inbound access from the mobile network, LAN services unreachable from outside |
bcp38, bogons |
on | Anti-spoofing and reserved-address filters; switchable on the Services page |
dnsmasq, odhcpd |
on | DNS forwarding and DHCP for the devices behind the unit (IPv4 and IPv6) |
wpad |
on | Wi-Fi access point |
uhttpd |
on | The web interface (HTTPS on the LAN) |
sshd |
on | Secure shell on the LAN, used for on-site service |
miwire-connection-manager, quectel-cm, wwan-monitor |
on | Brings up and watches the cellular data connection |
Device functions
Section titled “Device functions”| Service | At boot | Purpose |
|---|---|---|
modem |
on | Controls the cellular module: SIM, network registration, signal and cell information |
esimd |
on | eSIM profile handling |
motor, compass, miwire_app |
on | The directional antenna: motor control, heading, and the pointing algorithm that selects the best cell |
towerdb, cellScan, scanPing |
on | Cell tower position look-up and cell scanning used by the pointing algorithm |
ugps |
on | GPS receiver |
battery, power_controller, fan_control |
on | Power supply, battery and cooling management |
led, ledd |
on | The indicator light |
datausage_logs |
on | Local data-usage counters per period |
miwire_production |
on | Factory test hooks; inactive on a delivered unit |
MiWire management and security
Section titled “MiWire management and security”| Service | At boot | Purpose |
|---|---|---|
mqttd |
on | Status and command channel to the MiWire management system |
firmware_checkin |
on | Reports the firmware version to MiWire at boot |
autossh, autossh_monitoring |
on | The remote support tunnel to MiWire (see Services and ports) |
ssh_principals |
on | Keeps the unit’s remote-support access role current |
security_events |
on | The security event log; switchable on the Services page |
miwire_features |
on | Applies the feature switches below at boot |
Scheduled jobs and feature switches
Section titled “Scheduled jobs and feature switches”These are the entries of the second section of boot-services.txt. “On” means the job runs on a unit as delivered; the ones marked “by request” are enabled by MiWire for customers who ordered the function.
| Entry | Default | Purpose |
|---|---|---|
upload_statistics |
on | Hourly status report to MiWire (see Data processed) |
update_firmware_checker |
on | Hourly check for a firmware update offered to this unit |
renew_certificate, miwire_enroll |
on | Device certificate renewal and, if ever needed, re-enrollment |
health_check, internet_probe |
on | Liveness report to MiWire; internet reachability indicator for the web interface |
report_credential, root_rotation, shared_keys_remove |
on | Credential and access-key hygiene for remote support |
security_events |
on | Sends the security event log to MiWire |
security_log |
on | The security event log switch (Services page) |
bcp38, bogons |
on | The filter switches (Services page) |
refresh_esim_profiles |
on | Periodic eSIM profile refresh |
vnstati_summary, removeFiles |
on | Traffic graph for the status page; housekeeping of old local files |
getTA12Hour, checkStatus, moveDataToServer, upload_raspberryPi_identity |
on | Diagnostic snapshots and data transfer for MiWire support |
mqttd, firmware_checkin, datausage_logs, power_controller, esimd |
on | The service switches of the daemons above |
snmpd |
off | SNMP monitoring agent; enabled by MiWire support by request, with authentication |
performance_data |
off | Periodic throughput and latency tests; by request |
trackwire |
off | Timing-advance monitoring for position tracking; by request |
update_signal_metrics_loop, connection_health_metrics_loop |
on | Metric collectors for the SNMP agent (idle while SNMP is off) |
What the SBOM does not cover
Section titled “What the SBOM does not cover”The cellular module firmware. The 5G module (Quectel RM520N or a Telit FN990 family module) runs firmware from its manufacturer. It is installed on each unit individually at the factory, varies by module type, and is not part of the router firmware image, so it is not in the image SBOM. The module type and its firmware version are per-unit properties, recorded by MiWire for each unit and available on request; they are also readable on the unit itself.
The bootloader. The board’s bootloader is provided by the board manufacturer and is not updated by the firmware image.
Using the SBOM to check for known vulnerabilities
Section titled “Using the SBOM to check for known vulnerabilities”The SBOM can be fed to a vulnerability scanner that understands CycloneDX (for example by matching the cpe fields and name/version pairs against the NVD or OSV databases). Note that OpenWrt and MiWire backport security fixes to the shipped package versions, so a match on a version number does not by itself mean the unit is affected. MiWire publishes its assessment of relevant vulnerabilities on Advisories.