By default, the TI bq29312 Battery Protection AFE Embedded Controller in multiple Apple laptops installs with a default password. The TI bq29312 Battery Protection AFE Embedded Controller has a default unseal password of 0x36720414 and a hardcoded default full access mode password of 0xffffffff. This allows attackers to trivially access the program or system and gain privileged access.

Currently, there are no known upgrades or patches to correct this vulnerability. It is possible to temporarily work around the flaw by implementing the following workaround: Change the default password.

• News Article: http://blogs.forbes.com/andygreenberg/2011/07/22/apple-laptops-vulnerable-to-hack-that-kills-or-corrupts-batteries/
  http://www.engadget.com/2011/07/22/charlie-miller-finds-macbook-battery-security-hole-plans-to-fil/
  http://www.theregister.co.uk/2011/07/22/mac_battery_hack/
• Other Advisory URL: http://media.blackhat.com/bh-us-11/Miller/BH_US_11_Miller_Battery_Firmware_Public_WP.pdf
• Generic Informational URL: http://www.securitytube.net/video/2101

• Charlie Miller - Accuvant LABS

NVD does not currently have a CVSSv2 score assigned.