CVE-2026-50719

Katalog CVE

CVSS 6.8 · Medium EPSS 0,15%

Kerentanan Improper Access Control. Skor CVSS 3.1 6.8 (Medium) menurut CISA ADP.

Deskripsi (NVD)

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing modification of SRAM-resident secure boot state prior to the verification decision. An attacker with physical write access to boot media can inject an init-table entry that disables the secure boot check, causing the ROM to accept unsigned or modified first-stage boot code. This has been hardware-validated on a secureboot-enabled T41 device; ROM analysis confirms closely related behavior on T32, T40, and A1.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

9 September 2026

Status NVD

Deferred

CVSS 3.1

6.8 (Medium), sumber CISA ADP
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-347: Improper Verification of Cryptographic Signature
CWE-474: Use of Function with Inconsistent Implementations

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://opensensor.io/security/ingenic-t32-t40-t41-a1-init-table-bypass