Cannot access the factory.cgi page

[KarenChen-Linksys]

Steps:

1. Try to access 192.168.1.1/factory.cgi

**Actual Result: **
Lead to login page.

**Expected Result: **
Can be accessed 192.168.1.1/factory.cgi.

Screenshots

Additional context
log: log.txt

Related issue
#1105 [2.5.0] Can't access sysinfo.cgi or fwupdate.html
#1031 Hidden fwupdate page not supported
#1030 Hidden cpehelp page not supported
#1028 Hidden sysinfo page not supported

[AustinChangLinksys]

🔍 Automated investigation (preliminary triage)

Line: 2.x / USP (TR-369)

Root cause:

• Trigger: /factory.cgi is a firmware-served (lighttpd/CGI) hidden page, but the web server serves the PrivacyGUI SPA index.html for this path instead of routing it to the firmware CGI handler.
• UI defect: PrivacyGUI's go_router config has no route for .cgi paths (no factory.cgi / sysinfo.cgi / fwupdate.html entry in appRoutes, no .cgi passthrough), so the request boots the SPA, fails device-info fetch, and falls through the default redirect to the login page.

Evidence (from attached log.txt):

1. Accessing factory.cgi booted the PrivacyGUI SPA rather than a CGI page — App loads with no device model / no auth:

[D][App]: build: null
[D][ThemeConfigLoader]: Loading device theme for model:
[D][ThemeConfigLoader]: No model number, using default theme
[D][AuthService]: Stored login type: LoginType.none
[D][SessionService]: USP not authenticated

2. The SPA could not obtain device info and its router pushed the local login page (the observed "Lead to login page"):

[D][Prepare]: device info check - null
[I][Prepare]: Error handling for unable to get deviceinfo
[D][Route]: did push the page - localLoginPassword
[D][RouteChanged]:<localLoginPassword>

3. Code confirmation (lib/route/router_provider.dart, dev-2.5.0): the router redirect handles only /, /localLoginPassword, /autoParentFirstLogin, /pnp*, /remoteAssistance, /usp* and otherwise calls redirectLogic. There is no branch for .cgi / hidden firmware pages, and grep for factory/sysinfo/fwupdate/cpehelp routes in lib/route/constants.dart returns nothing — the SPA has no notion of these firmware-served pages, so any such URL resolves to login.

Confidence: Medium — behavior is reproduced and localized in code + log (SPA intercepts the path, no CGI route exists), but confirming that the web server should hand .cgi paths to the firmware handler (vs. SPA) requires firmware/web-server routing confirmation.

This is consistent with the related "hidden page not supported" series (#1028 / #1030 / #1031 / #1105).

---

Auto-generated triage by Austin's tooling, pending Austin's review. Not a fix commitment.