CVE-2026-50720
Received Received - Intake

Ingenic T31 SoC Secure Boot Signature Bypass

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: MITRE

Description
The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modified SPL (Secondary Program Loader) images that pass secure boot verification without possession of the OEM signing key. Each forgery attempt succeeds with approximately 2/3 probability. This has been validated via reverse engineering, software emulation against vendor-signed images, and end-to-end hardware acceptance of a forged firmware image on a Wyze Video Doorbell v2 (T31X).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-50720
EUVD
EUVD-2026-62480

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ingenic t31_soc *
wyze video_doorbell_v2 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-50720 is a flaw in the Ingenic T31 SoC's Boot ROM where secure boot verification only checks a single 32-bit word of the RSA signature instead of the full output. This weakens security from 128 bits to just 32 bits, allowing attackers to forge modified boot images without the OEM signing key.

Detection Guidance

Detection involves comparing SPI NOR flash contents against known-good vendor images. Use tools like flashrom to read the SPI NOR chip and compare the extracted firmware against a trusted reference image. Ensure physical access to the device for this process.

Impact Analysis

An attacker with physical access to the device's boot media can replace the firmware, execute arbitrary code, and maintain persistence even after factory resets. This could lead to full device compromise, data theft, or unauthorized access. Exploitation takes about 3-4 minutes with common hardware.

Compliance Impact

This vulnerability likely violates compliance requirements for secure boot and firmware integrity in GDPR and HIPAA, as it undermines trusted device authentication. Organizations using affected devices may face non-compliance risks due to inadequate protection against unauthorized firmware modifications.

Mitigation Strategies

Disable in-circuit flashing interfaces, enable SPI-NOR write protection via eFuse if available, and monitor the chain of trust. Physically harden devices to prevent unauthorized access to boot media. No firmware update can patch this issue as it is in the mask ROM.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50720. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart