Christopher Childress

The production debug interface is not logically disabled at the firmware or chip level, and the bootloader remains unlocked. An attacker with physical access can restore physically severed debug traces to interrupt the boot process and manipulate boot parameters. This allows the attacker to enter a non-standard initialization path that exposes an unauthenticated root shell during startup, potentially leading to full root-level command access and loss of confidentiality, integrity, and availability.

An information disclosure issue exists in the local discovery mechanism. This allows an unauthenticated attacker on the same local network to retrieve sensitive geolocation information by sending crafted responses. The issue affects confidentiality without impacting integrity or availability.

The firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access to the firmware image can extract this embedded key. Successful exploitation may allow an unauthenticated attacker on the same network to use the key within the web management service, compromising the confidentiality of encrypted communications. This can lead to the theft of admin credentials through passive decryption of traffic or active man-in-the-middle (MITM) attacks, where an attacker intercepts and potentially alters communication between two parties.