Description
With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable). Thus, the attacker gains access to the bootloader, where the kernel command line can be changed. An attacker is able to gain a root shell through this vulnerability.
Problem types
CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks
Product status
92xx-k7:
Credits
Clemens Stockenreitner, SEC Consult Vulnerability Lab
Werner Schober, SEC Consult Vulnerability Lab
References
r.sec-consult.com/dormakaba
r.sec-consult.com/dkaccess
www.dormakabagroup.com/en/security-advisories