ID: MEDIUM-03

Title: U-Boot bootloader console accessible via UART

Severity: Medium

CVSS Score: 6.8

CVSS Vector String: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description: The U-Boot bootloader autoboot sequence was successfully interrupted via the UART serial interface, yielding an interactive bootloader console. The autoboot delay of one second is insufficient to prevent interruption with automated tooling and access to the bootloader console enables direct read and write access to flash memory partitions. This allows for firmware extraction, modification, or corruption, including potential bricking of the device.

Remediation: Configure U-Boot with a password-protected console. Reduce or eliminate the autoboot delay. Consider disabling serial console access in production builds.

More information: See Boot and Runtime Analysis chapter.