The backup restore function on the Verizon MiFi 6620L, version 4.5, allows a user to modify critical system files on the device such as the 'root' user's crontab file.
The backup restore function allows a user to upload previously saved configuration files to restore the device to a known state. The backup file is a base64-encoded, encrypted zip file. It can be encrypted and decrypted using the 'nvtl_encrypt' utility on the device. The encryption mechanism is not unique to the device, and configurations can be shared across devices.
An authenticated user can download a copy of their device's configuration file through the web interface, decode and decrypt it, then modify the zip to include a 'root' crontab file. After re-encrypting and re-encoding, the user uploads the modified configuration through the restore function. In this way the user can execute commands on the device as root through the crontab function.