SearchSubscribe

TRA-2026-38

Debug UART exposes root shell on smart building gateway

An unauthenticated serial console on the board drops to a root shell, giving physical attackers control of every connected sensor.

  • No patch
  • IoT & embedded

CVSS 3.1 base score

6.8medium

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor
Ostra
Product
Ostra Hub BX-200
CVE
  • CVE-2026-36690
Disclosure
105 days
Researchers
Daniel Okafor

Score breakdown

Exploitability

Attack vector
Attack complexity
Privileges required
User interaction

Scope

Scope

Impact

Confidentiality
Integrity
Availability

Affected products

ProductAffectedFixed in
Ostra Hub BX-200All firmware versionsNo fix yet

Questions about this advisory

research@tenable.com
On this page6 sections
  1. Score breakdown
  2. Affected products
  3. Synopsis
  4. Proof of concept
  5. Solution
  6. Disclosure timeline

Synopsis

An unauthenticated serial console on the board drops to a root shell, giving physical attackers control of every connected sensor.

Proof of concept

Tenable has shared a proof of concept with Ostra. It is not published here, to give operators time to apply the fix.

Solution

No firmware update is available. Restrict physical access to deployed gateways and fit tamper-evident seals to the enclosure.

Disclosure timeline

  1. Tenable reports the issue to Ostra

  2. TRA-2026-38 published

105 days from report to publication, against a 90-day policy.How we disclose