The ecobee3 lite hardware board contains a Universal Asynchronous Receiver/Transmitter (UART) interface on the application board that allows a threat actor to access a password-protected interactive shell. The password for the shell can be recovered through firmware reverse engineering, allowing a threat actor to gain underlying operating system access to the device.
The ecobee3 lite device has the UART interface obscured on the PCB board. The research team connected to the serial/UART interface using a USB-to-serial adapter.
The team was able to intercept autoboot using the discovered root password and subsequently gain console access to the full device.
The ecobee3 lite hardware board carries a UART interface on the application board that exposes a password-protected interactive shell. Advisory L9-15-158 classifies this as an unprotected debug port. The shell password can be recovered by reverse engineering the firmware, which gives a threat actor access to the underlying operating system.
The UART interface is obscured on the ecobee3 lite printed circuit board. The research team connected to it with a USB to serial adapter, interrupted autoboot using the recovered root password, and reached a console on the full device. Advisory L9-15-158 lists version 4.5.81.200 as affected.
The interface sits on the ecobee3 lite application board itself, and the research team reached it by connecting a USB to serial adapter to that interface. The advisory describes no network path to this shell. It is a hardware level finding rather than a remote one.
The advisory states the shell password can be recovered through firmware reverse engineering. A separate ELTON advisory, L9-15-160, covers hard coded default root credentials that exist across all ecobee3 lite devices, and L9-15-159 covers the unencrypted NAND flash storage the firmware is read from.