From the article it seems like there are two separate things: * root shell accessible using UART header -> this is more or less fine as you said. Because at th

From the article it seems like there are two separate things: * root shell accessible using UART header -> this is more or less fine as you said. Because at that point you might as well solder wires to intercept communication between RAM and CPU, unsolder flash memory chip containing firmware and connect it to a dedicated reader/writer, or possibly use the CPU debug port. It would be a bit more difficult than using serial connection over UART, but not different from the perspective of overall security model. Note that a physical serial port with shell access is not the same as SSH. * SSH server listening on ??? network interfaces. Using the UART shell author was able to recover admin password, which might be usable for connecting using SSH over network. But it wasn't really confirmed whether the SSH server is configured to accept passwords and on which network interfaces is it listening. If the SSH server is really accepting hard coded password and listening on all interfaces by default then it's very bad. But the article after getting admin password jumped to completely unrelated stuff of modifying firmware downloaded from manufacturers website and uploaded using the firmware update feature in web interface.