INSTAR 2K+ and 4K UART Interface Improper Physical Access Control Vulnerability

A vulnerability exists in INSTAR 2K+ and 4K cameras running firmware 3.11.1 Build 1124. This issue arises from an exposed UART debug interface, which can be accessed physically. The vulnerability allows unauthorized users to interrupt the boot process and access the U-Boot bootloader. From there, boot parameters can be modified to launch a shell with elevated privileges, granting root access without authentication.

Impact

Exploitation of this vulnerability allows for unauthorized physical access control, enabling an attacker to gain root privileges on the device.