CVE-2023-48424

The vulnerability concerns the U-Boot bootloader shell present in the firmware of Google Chromecast devices. The vulnerability allows an attacker to obtain elevated privileges in the device's production environment. The detailed technical mechanism has not been disclosed in the available description, however the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates that the attack can be conducted remotely, without user interaction and without required privileges.

An attacker can obtain elevated privileges on the device, which consequently may lead to complete takeover of the device, violation of confidentiality, integrity, and availability of Chromecast data and functions.

Apply patches available from the manufacturer according to references — Chromecast security bulletin dated 2023-12-01 available at: https://source.android.com/docs/security/bulletin/chromecast/2023-12-01. It is recommended to update the device firmware to the latest version.

Google Chromecast and Google Chromecast firmware — specific versions indicated in the Chromecast security bulletin from December 2023 (2023-12-01) available in manufacturer references