Rethesis

An unauthenticated debug service is exposed on TCP port 9000. This allows a LAN-based attacker to execute arbitrary UCC commands via the '/sbin/mtk dut' binary.

The Wi-Fi device blocking feature fails to sanitize MAC address input, which allows for the injection and execution of arbitrary shell commands.

Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header. The system fails to block requests when the Base64 decoding process fails, allowing potentially unauthorized access.

Improper access control in the MQTT broker allows unauthorized actors to use wildcard topic subscriptions, which exposes all MQTT traffic.

Crafted MQTT messages can trigger command injection, allowing for root-level remote code execution on the target device without requiring authentication.