A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.