The hardware_monitor helper, which runs as root, reads lines from the Android log (logcat) and passes a field from each line to a shell eval. Any process on the device can write to logcat, so a local unprivileged attacker can inject a command that the root helper executes.

Affected firmware: v0.3.9.7 through v0.6.6.9 (last release; device is EOL/unsupported). Verified on device (uid=0).