A flaw in Beetel 777VR1 allows an attacker with physical access to interact with the UART interface without authentication. The vulnerability originates from missing authentication checks on an unknown UART function, enabling control of the device’s internal state and potentially remote commands. This weakness aligns with CWE‑287 and CWE‑306 and could lead to unauthorized device manipulation, impacting confidentiality, integrity, and availability.

The issue affects Beetel's 777VR1 series, specifically firmware versions up to 01.00.09/01.00.09_55. Systems running these firmware releases are vulnerable; newer releases should be checked for fixes.

The CVSS base score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is classified as difficult to exploit and requires physical access to the UART port, which limits the attack surface. Because it is not listed in the CISA KEV catalog, there is currently no widely recognized exploitation, though the public exploit code is disclosed. The lack of an official vendor patch means that mitigations must be applied manually, and the situation remains a high operating risk for exposed devices.