I played around with an old router I had lying around. It is a TP-LINK, model TL-WDR3600 (N600 Wireless Dual Band Gigabit Router). After opening the case you can see a 4-pin connection point that is apparently a serial port. The pinout being 3.3V, GND, TX, RX.
After powering it up with a 12V adapter and connecting to the serial port with a USB-to-Serial dongle you can get to a Linux login prompt. After a bit of searching I found out there is a root account with a factory default(!) password ‘sohoadmin’ [Source].
Logging into the TL-WDR3600 as root gives you a BusyBox shell with an ancient 2.6 Linux kernel. The root mount point seems to be a read-only (flash?) storage, so no fun to be had here. The system would probably need to be re-flashed to change any of the contents.