ID: MEDIUM-01

Title: Unauthenticated JTAG debug access on production hardware

Severity: Medium

CVSS Score: 6.8

CVSS Vector String: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description: Having identified the JTAG interface, the JTAG debug port was found to be fully unlocked. Actions like halting CPU execution and reading of MIPS32 registers were possible. Since no authentication or protection mechanism prevented access, an attacker with physical access to the device could, at any point, inspect CPU state, extract firmware directly via JTAG, and potentially modify memory contents.

Remediation: Enable JTAG fuse-based locking in production firmware to prevent debug access. Implement secure boot with debug port disabled. At minimum, ensure physical access to the device is restricted.

More information: See JTAG Interface Discovery chapter.