Firmware vulnerabilities

An unauthenticated remote attacker can recover a default, hard-coded password from a firmware image and gain full access to all affected devices.

An unauthenticated remote attacker can force the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.

CWE-522 Insufficiently Protected Credentials vulnerability allows an unauthenticated attacker to access credentials stored in firmware or system files. This can lead to unauthorized access and exposure of sensitive information, and with physical access to the device, full compromise.