CVE-2026-50719

{
  "id": "CVE-2026-50719",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-19T14:17:31.977",
  "lastModified": "2026-11-09T20:10:00.200",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing modification of SRAM-resident secure boot state prior to the verification decision. An attacker with physical write access to boot media can inject an init-table entry that disables the secure boot check, causing the ROM to accept unsigned or modified first-stage boot code. This has been hardware-validated on a secureboot-enabled T41 device; ROM analysis confirms closely related behavior on T32, T40, and A1."
    },
    {
      "lang": "es",
      "value": "Las ROM de arranque de los SoC Ingenic T41, y probablemente también T32, T40 y A1, analizan y ejecutan una tabla init controlada por el atacante desde el encabezado SPL antes de verificar el estado de arranque seguro y antes de invocar la verificación de firma. El analizador de la tabla init admite operaciones de escritura de 32 bits de dirección completa, lo que permite la modificación del estado de arranque seguro residente en la SRAM antes de la decisión de verificación. Un atacante con acceso físico de escritura al medio de arranque puede inyectar una entrada en la tabla init que deshabilita la verificación de arranque seguro, haciendo que la ROM acepte código de arranque de primera etapa sin firmar o modificado. Esto ha sido validado por hardware en un dispositivo T41 con arranque seguro habilitado; el análisis de la ROM confirma un comportamiento estrechamente relacionado en T32, T40 y A1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "PHYSICAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-24T20:01:10.334363Z",
          "id": "CVE-2026-50719",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-347"
        },
        {
          "lang": "en",
          "value": "CWE-474"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://opensensor.io/security/ingenic-t32-t40-t41-a1-init-table-bypass",
      "source": "[email protected]"
    }
  ]
}