Ingenic T41 SoC Boot ROM Secure Boot Bypass

Executive Summary

CVE-2026-50719 is a vulnerability in Ingenic T41, T32, T40, and A1 SoC boot ROMs. The boot ROM's init table parser executes before secure boot checks and signature verification. An attacker with physical access to boot media can inject a malicious init table entry that clears SRAM security flags, bypassing secure boot and allowing unsigned code execution.

Useful 0 Not Useful 0

Detection Guidance

Detection requires physical inspection of boot media for unauthorized modifications to the SPL header or init table. Check for unexpected writes to SRAM security flags or boot state changes. Use tools like flashrom to read and verify the SPI NOR boot media contents against known-good images.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with physical access to boot media to execute unsigned code, replace firmware, and achieve persistence across reboots. Since the flaw is in mask ROM, it cannot be patched via firmware updates, requiring hardware changes or physical access restrictions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution and firmware tampering, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Compliance may be compromised if secure boot is bypassed, allowing unauthorized access to sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict physical access to boot media and SPI NOR flash. Disable or remove write permissions for unauthorized users. If secure boot is enabled, verify its functionality and consider migrating to unaffected hardware since the flaw is in mask ROM and cannot be patched.

Useful 0 Not Useful 0