CWE-1191

Mikrokontroler respiratora nie posiada mechanizmów ochrony pamięci, co umożliwia atakującemu fizyczny dostęp do wewnętrznego interfejsu JTAG i manipulację pamięcią flash urządzenia. Podatność jest szczególnie niebezpieczna ze względu na krytyczne zastosowanie medyczne urządzenia — zakłócenie jego działania może stanowić bezpośrednie zagrożenie dla życia pacjenta.

Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromise data confidentiality or integrity.

On-Chip Debug and Test Interface With Improper Access Control and Improper Protection against Electromagnetic Fault Injection (EM-FI) in Nordic Semiconductor nRF52810 allow attacker to perform EM Fault Injection and bypass APPROTECT at runtime, requiring the least amount of modification to the hardware system possible.

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the root shell on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary commands with root privileges on the targeted system.

As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and retrieve sensitive information such as details about the current and previous Wi-Fi network from the NVS partition. Additionally, this allows the adversary to reflash the device with their own firmware which may contain malicious modifications.

On-chip debug and test interface with improper access control in some 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.

The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on an ESP32 in a commercial product an attacker with physical access to the device can connect over this port and reflash the device's firmware with malicious code which will be executed upon running. As a result, the victim will lose access to the functionality of their device and the attack may gain unauthorized access to the victim's Wi-Fi network by re-connecting to the SSID defined in the NVS partition of the device.

A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the interface, access to the bootloader is possible, as well as a Linux login prompt. The bootloader access can be used to gain a root shell on the device. This issue is fixed in recent firmware versions BSP >= 6.4.1.

This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by identifying UART pins and accessing the root shell on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to access the sensitive information on the targeted system.

Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port.

Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access via attacker controlled hardware that can be attached to the Mini-PCI Express slot on the motherboard that hosts the WiFi card on the device.

Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control.

Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control.

Successful exploitation of the vulnerability could allow an attacker that has physical access to interface with JTAG to inject or modify firmware.

Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously crafted command causing the VCN FW to perform read/writes HW registers, potentially impacting confidentiality, integrity and availabilability of the system.

The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the interface, full access to the device is possible. This enables an attacker to extract information, modify and debug the device's firmware. All known versions are affected.

Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

A vulnerability classified as critical has been found in FNKvision FNK-GU2 up to 40.1.7. Affected is an unknown function of the component UART Interface. The manipulation leads to on-chip debug and test interface with improper access control. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

Sprzętowy odtwarzacz CleverDisplay BlueOne ma interfejsy USB fizycznie zamknięte i niedostępne w normalnych warunkach działania. Badacze wykazali, że po obejściu ochronnej obudowy urządzenia możliwe było podłączenie klawiatury USB i naciśnięcie ESC podczas uruchamiania w celu dostępu do interfejsu ustawień BIOS-u. Ustawienia BIOS-u można było przeglądać, ale nie modyfikować. To zachowanie nieznacznie zwiększa powierzchnię ataku poprzez ujawnienie wewnętrznych informacji systemowych (CWE-1244) po usunięciu obudowy, ale nie pozwala na naruszenie integralności lub dostępności w standardowych lub testowanych konfiguracjach.

Odkryto podatność w TOZED ZLT M30s do wersji 1.47. Zagrożenie dotyczy niezidentyfikowanej funkcji komponentu UART Interface. Manipulacja może prowadzić do dostępu do interfejsu debug i testowania na chipie z nieprawidłową kontrolą dostępu. Atak wymaga bezpośredniego dostępu fizycznego do urządzenia i jest bardzo złożony. Exploit został ujawniony publicznie, a producent nie udzielił odpowiedzi na powiadomienie.