Researchers at firmware security firm Binarly have disclosed six new vulnerabilities in U-Boot, the small program that starts up hardware as varied as home routers, smart cameras, and the management chips inside data-center servers, as reported by The Hacker News. A malicious image could crash a device or run code during boot.

Code that runs at boot is unusually powerful because it runs first. The bootloader hands control to everything that follows, so a foothold there sits below the operating system and the security controls that only come online later. That is what makes boot-level flaws attractive for stealthy, persistent firmware attacks.

The breadth is the other concern. U-Boot is embedded across a huge range of devices, many of which are rarely if ever updated after they leave the factory. A bug in shared low-level code like this tends to have a very long tail, because the affected hardware outlives anyone's attention to its firmware.

For most organizations the practical response is inventory and updates where they exist. Know which devices run U-Boot, apply vendor firmware updates as they appear, and treat embedded gear as the long-lived, under-monitored attack surface it usually is rather than assuming it is fine because it has run without trouble.

Sources: The Hacker News, BleepingComputer.