ID: MEDIUM-04

Title: Accessible root shell through UART serial interface.

Severity: Medium

CVSS Score: 6.8

CVSS Vector String: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description: The UART serial console exposes a runtime authentication prompt on the production device. Using the root password recovered as detailed in finding HIGH-01, root shell access was successfully obtained without any additional authentication factor. From the obtained root shell an attacker can read all device data, modify configuration, extract firmware, and potentially brick the device.

Remediation: Disable the runtime serial console in production builds. If console access is required for maintenance, implement strong credential policies and hardware-level access controls to prevent unauthorised physical access to the serial interface.

More information: See Boot and Runtime Analysis chapter.