InfoSecBulletin Cybersecurity for mankind
A security researcher has unveiled a major vulnerability in a popular payment terminal that could allow attackers to take full control of the device in less than a minute. The Worldline Yomani XR model is used in grocery stores, cafes, repair shops, and various businesses in Switzerland.
The terminal’s maintenance port, despite being secure, exposes an unsecured root shell that allows remote access to anyone with brief physical access.
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Unlocked Root Shell and Accessible Debug Port:
When first powered on, the terminal appears to behave normally. A quick network scan yields no open ports.
An internal analysis found an unused debug connector on the device’s back panel, hidden under a small hatch. After connecting a serial cable and powering it up, the researcher saw a typical Linux boot log.
The system uses a 3.6 kernel built with Buildroot in early 2023, featuring BusyBox utilities and uClibc libraries. A login prompt shows up on the serial console after booting.
Entering “root” at the prompt grants immediate access to a full root shell. No password barrier, no encryption just one word.
Once inside, an attacker could install malware, capture transaction data, or pivot into back-end networks.
Physically, the Yomani XR is impressively engineered. The terminal uses a custom dual-core Arm ASIC (“Samoa II”), multiple tightly compressed PCBs, and extensive tamper detection features.
Pressure-sensitive zebra strips and zig-zag copper traces on each board detect unauthorized disassembly by breaking circuits.
A coin-cell battery ensures tamper protection remains active even when power is removed. Exposed wiring or drilling into the PCB would trigger an irreversible red screen, rendering the terminal inoperable.
Yet these hardware safeguards do not cover the debug interface. The reveal of an unsecured serial port undermines the design’s overall security goals.
Further firmware analysis shows the terminal actually runs two separate processing environments.
The first core boots an “insecure” Linux application that handles network communication and general business logic.
This core is responsible for loading a second, “secure” firmware image onto a dedicated processor that manages the card reader, keypad, and display.
That secure image is encrypted and signed, and only runs if tamper protections are intact. As a result, even if attackers access the Linux shell, they cannot directly manipulate card handling without breaching the secure core.
However, compromise of the application core still poses significant risk. Attackers could disrupt updates, log network traffic, or install backdoors to later target the secure processor.
While no public evidence exists of stolen card data through this route, the exposure of an unprotected root shell remains a critical oversight.
Merchants relying on these terminals should inspect devices for unauthorized access hatches and ask vendors for firmware updates that disable the external debug port.
Worldline has been notified and reportedly fixed the issue in later firmware releases. Until those updates are widely deployed, terminal operators face an unnecessary risk hidden beneath robust hardware defenses.
