CVE-2023-48425

The vulnerability affects the U-Boot component — the bootloader responsible for system initialization on Google Chromecast devices. Based on the classified CWE-20, it indicates insufficient validation of input data in this component. Exploiting the vulnerability leads to persistent code execution, meaning that malicious code can survive device restarts. A network attack vector (AV:N) without authentication requirements (PR:N, UI:N) suggests the possibility of remote exploitation of the vulnerability.

An attacker can gain full control over the device — ensuring the highest level of confidentiality, integrity, and availability of the system, and the executed code can remain permanently on the device even after a restart.

Patches available from the manufacturer should be applied according to references — the Chromecast security bulletin dated 2023-12-01 is available at: https://source.android.com/docs/security/bulletin/chromecast/2023-12-01. Google Chromecast devices typically receive updates automatically, however administrators should verify that devices in the organizational environment have the latest firmware version installed.

Google Chromecast and Google Chromecast firmware software — specific versions indicated in the manufacturer's security bulletin from December 2023 (2023-12-01).