Reviving a Cricut from the e-waste bin by spoofing its serial over USB

A tinkerer rescued a Cricut Maker from the trash, expecting the perished rollers to be its only problem. The real obstacle was Cricut’s remote lockout: the machine powered on and passed self-test but reported itself “deactivated” when it connected to Cricut’s software, likely because the original owner had swapped it under warranty or a trade-in. After ruling out rewriting an on-board EEPROM (there wasn’t one, and the MCU had no accessible debugger) and abandoning a network-interception route blocked by certificate pinning, the author went after the USB link between the cutter and the PC.

A Wireshark capture of the USB CDC traffic revealed the machine’s serial number sent in the clear, with no checksums or encryption. Using an RP2040 as a man-in-the-middle that acts as both USB host and client, they built a proxy that watches for the serial-number packet and swaps in a different value on the fly. To the software the swap is invisible: the unit appears in the account as legitimate. Notably, arbitrary serials worked too, including numbers that don’t exist on Cricut’s public unit-status page.

The interesting takeaway is less the repair than the exposure it reveals. Because serials are sequential, cleartext, and unauthenticated, the same trick could let someone claim or lock out serial numbers belonging to other owners. The author lists softer software-only alternatives (patching the app, a Bluetooth proxy, hijacking the firmware update path) but declines to publish the code, citing uncertainty over Australian copyright law. It’s a pointed case study in vendor-imposed bricking, right-to-repair friction, and the weak device-identity controls behind subscription-era hardware.