ID: INFO-02

Title: Sensitive device information disclosed via UART boot output

Severity: Informational

CVSS Score: -

CVSS Vector String: -

Description: The UART serial console outputs detailed device information during the boot process that is visible to anyone with physical access to the this interface. This boot log discloses sensitive information including the exact memory addresses and sizes of all flash partitions, the Linux kernel version, hardware configuration details, and bootloader version. Much of the same information was independently confirmed through static analysis of the extracted U-Boot partition demonstrating that this information is accessible both at runtime and through offline firmware analysis. This information assists an attacker in planning targeted attacks against specific memory regions and identifying known vulnerabilities associated with disclosed software versions.

Remediation: Suppress or reduce verbose boot output on the serial console in production builds. If boot logging is required for maintenance purposes, implement hardware-level access controls to prevent unauthorised physical access to the serial interface.

More information: See Boot and Runtime Analysis and Manual Firmware Analysis chapters.