Critical Firmware Flaw: PSK Exposed in Plaintext on Device Flash, UART, and LCD at First Boot

A critical security vulnerability exposes the primary authentication key (PSK) of a device in plaintext across multiple attack vectors immediately upon first boot. The PSK is stored as raw bytes in flash memory, protected only by a CRC checksum, and is simultaneously printed to the UART serial interface and displayed on the device's LCD screen. This design flaw provides multiple trivial paths for an attacker with brief physical or visual access to compromise the entire system.

The vulnerability is rooted in two source files. In `key_store.c`, the PSK is written to flash without any encryption, relying solely on a checksum for integrity. Concurrently, `main.c` contains logic that outputs the generated key via `printf` to the UART and renders it on the LCD display during the initial boot sequence. This means the secret is exposed to anyone who can connect a serial cable, perform a simple flash memory dump, or merely observe the device's screen at startup.

The severity is assessed as medium, as exploitation requires a form of physical access. However, the impact is high because the exposed PSK is described as the sole authentication mechanism for the device. The suggested fixes are to immediately halt the practice of printing the key to UART or LCD, instead providing a secure method (like an authenticated `/key` command or a physical button press) to retrieve it. For devices where physical security is paramount, the recommendation is to encrypt the PSK storage sector using a hardware-based key, such as the RP2350's One-Time Programmable (OTP) key.