CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in CarlinKit CPC200-CCPA devices. This issue arises from a misconfiguration in the application system-on-chip (SoC), specifically the absence of a properly established hardware root of trust. As a result, local attackers who can execute low-privileged code may exploit this vulnerability to escalate privileges and run arbitrary code during the boot process.

Impact

Exploitation of this vulnerability allows local attackers to escalate privileges and execute arbitrary code in the context of the boot process.