Firmware image required cracking the root password and figuring out the kernel version.
Full writeup:
[https://ctf.rip/write-ups/iot/firmware/wormcon-firm/#firm1](https://ctf.rip/write-ups/iot/firmware/wormcon-firm/#firm1)