Alexander Plaskett

An unauthenticated remote attacker can use this issue to change the device configuration due to a file being writeable for a short time after system startup.

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user `user-app` to the default password. The issue is related to insecure default resource initialization.

A vulnerability exists in the U-Boot component of the firmware that allows persistent arbitrary code execution with Linux kernel privileges. This is due to a failure to correctly handle the return value of the `setenv` command, which can be used to override the kernel command-line parameters and ultimately bypass the Secure Boot implementation. The affected products include PLAY5 gen 2, PLAYBASE, PLAY:1, One, One SL, and Amp.

The issue is related to a stack buffer overflow in the mt 7615.ko wireless driver, which can be exploited to allow remote code execution within the kernel. This occurs due to the driver not properly validating an information element during negotiation of a WPA2 four-way handshake. The affected products include Amp, Arc, Arc SL, Beam, Beam Gen 2, Beam SL, and Five.