CVE-2023-48426

A flaw in the u-boot bootloader implementation on Google Chromecast devices allows interaction with the u-boot shell and interruption of the boot sequence through the UART interface without requiring authentication. The lack of required identity verification (CWE-306) means that anyone with physical or logical access to the UART interface can issue commands directly in the bootloader environment. This enables interference with the system startup process at a very low level.

An attacker can gain full control over the device boot process, potentially modifying or replacing firmware, bypassing secure boot mechanisms, and obtaining elevated privileges in the system — resulting in complete violation of confidentiality, integrity, and availability.

Apply patches available from the manufacturer according to references — Google Chromecast security bulletin from December 2023 (2023-12-01) available at: https://source.android.com/docs/security/bulletin/chromecast/2023-12-01

Google Chromecast Firmware on devices: Google Chromecast GA00439, Google Chromecast GA3A00403A14, Google Chromecast H2G2-42, Google Chromecast NC2-645B