ID: MEDIUM-02

Title: Firmware directly readable and writable via SPI flash chip

Severity: Medium

CVSS Score: 6.8

CVSS Vector String: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description: The S25FL127S SPI flash chip containing the device firmware is directly accessible using hardware test clips and CH341A programmer without requiring any interaction with the device’s software or bootloader. Using the flashrom utility, a byte-perfect firmware image was successfully extracted, a specific byte was modified and written back to the chip, and the write was independently verified. The original firmware was subsequently restored. Full read and write access to the flash chip means an attacker with physical access can extract all firmware contents including credentials and proprietary binaries, flash modified or backdoored firmware, or corrupt the flash entirely rendering the device unbootable.

Remediation: Implement flash encryption to prevent direct reading of firmware contents via physical SPI access. Consider write protection mechanisms available on the S25FL127S chip. Physical protection measures such as epoxy potting increase the difficulty of chip access.

More information: See Firmware Extraction chapter.