ID: INFO-09

Title: All processes run as root with no privilege seperation.

Severity: Informational

CVSS Score: -

CVSS Vector String: -

Description: Every userspace process on the device runs under the root account (UID 0), including the web server (httpd), SSH daemon (dropbear), DHCP client and server (udhcpc, udhcpd), DNS proxy (dnsproxy), and wireless daemon (hostapd). The absence of any privilege separation means that a successful exploit against any single service immediately yields full root-level access to the device, with no further privilege escalation required.

Remediation: Apply the principle of least privilege by running each service under a dedicated, unprivileged user account with only the permissions required for its function.

More information: See System Hardening Analysis chapter.