CVE-2026-80253
Received Received - Intake

Improper Physical Access Control in ShizenBox2

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: JPCERT/CC

Description
An improper physical access control issue exists in ShizenBox2 (dev-conf). If exploited, an attacker with physical access to the product may execute bootloader commands without authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-80253
EUVD
EUVD-2026-70367

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
shizen_connect_inc shizenbox2 to 1.0.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1263 The product is designed with access restricted to certain information, but it does not sufficiently protect against an unauthorized actor with physical access to these areas.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper physical access control issue in ShizenBox2 (dev-conf). An attacker with physical access can execute bootloader commands without authentication.

Detection Guidance

This vulnerability requires physical access to the device, so network detection is not applicable. Check for unauthorized bootloader access by monitoring physical device interactions or reviewing logs for unexpected bootloader command executions.

Impact Analysis

An attacker could gain unauthorized access to critical system functions, potentially leading to data theft, system manipulation, or denial of service.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) compliance.

Mitigation Strategies

Update ShizenBox2 (dev-conf) to the latest version provided by Shizen Connect Inc. to address the authorization bypass issue. Ensure physical access controls are in place to prevent unauthorized individuals from accessing the device.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart