To ensure that the bootloader can not see the environmental variables at boot, timing is critical

This little “smart hub” (presumably, a device linking together a series of smart home devices) has a method which affords the user root access. From there, one can also enable SSHing to this device.

https://www.exploitee.rs/index.php/Staples_Connect_Hub​​

this causes U-Boot to drop into a interactive shell over UART

Many methods exist for this “Smart hub”, although only one appears to still be functional after various firmware patches. It involves shorting the NAND’s pins upon kernel reading. From there, a root shell can be accessed by altering kernel arguments.

https://www.exploitee.rs/index.php/Wink_Hub​​