My bad, I forgot to search for the additional URL before posting. Searching by ESP32 and Espressif didn’t bring any similar results, hence the dupe. It would be great if there was an automatic pre-check before we post something ;-)

It's absolutely a good thing, and arguably not a security issue at all.

It needs access to the command interface of the chip, which means you need to either have physical access to the device or compromise whatever is physically connected to the device.

It's practically like calling a read/write filesystem a security issue. Yes, an attacker can write to disk and persist there, and they can overwrite files, etc. But there needs to be a flaw that allows access to that behaviour first, else it's just a part of the interface.

And in this instance, it's a part of the debug interface of the chip. And practically makes it a perfect candidate for future bluetooth security tools, similar to the Atheros chipsets used for WiFi sniffing. Now we can do bluetooth impersonation attacks for $2 instead of hundreds.

Betting there'll be some good bluetooth research in the near future, showing all sorts of devices are vulnerable to attacks using $2 hardware. That's the real security problem here.

esp devices are generally super easy to replace the firmware on. I have PetLibro Water Fountains that use a weight sensor powered by a esp32. I opened the base, attached three wires to the uart output on the processor, flashed esphome firmware and loaded it into home assistant, completely cloud free monitoring.

The undocumented instructions isn't a backdoor at all, it requires you to have local access or have already taken control over the firmware via another bug. The only thing that people going nuts over a "backdoor" will do is cause espressif to close up their interfaces, which would make it harder in the future to repurpose the hardware.

This is not a remote exploit. It's not even a backdoor. It's just a bunch of undocumented interface commands that allow access to things like memory. To exploit any of this you need an attacker have physical access or get to run privileged software on the device. In both cases you'd already be totally screwed anyway. This is a clickbait nothingburger and that's the reason why it was presented at a random local conference. An actual backdoor that infects billions of wireless devices would have easily earned you a top presenter spot at a highly prestigious conference.