UNCOVERING A 0-CLICK RCE IN THE SUPERNOTE NOMAD E-INK TABLET

Summary from the TLDR InfoSec newsletter

There was a remote code execution vulnerability in the SuperNote A6 X2 Nomad tablet that let attackers on the same network compromise the device without user interaction. The exploit involved identifying an open port with a custom HTTP server, discovering a path traversal flaw for arbitrary file placement, and uploading a malicious firmware update to the EXPORT directory, which auto-installs using publicly available debug keys. The exploit was responsibly disclosed to Ratta Software in July - the company acknowledged it and made plans to fix it in its December 2024 update, but a patch has yet to appear.