8 matches found
Xiaomi-C200-Firmware-Analysis
The Scope In this repo i will show how i got access to the UART interface even without the common set of exposed pins / test pads, using U-Boot and tricks to gain root on an early stage and eventually dumping the firmware Initial Reconnaissance There are a few key things clear from the PCB Chip...
CVE-2026-50720
The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...
CVE-2026-50720
The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...
EUVD-2026-62480
The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...
PT-2026-78355
Name of the Vulnerable Software and Affected Versions Ingenic T31 SoC affected versions not specified Description The boot ROM flash-boot verification path in the Ingenic T31 SoC incorrectly compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256...
CVE-2026-50720
The Ingenic T31 SoC contains a vulnerability in the boot ROM flash-boot verification path where it only compares a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest. This improper cryptographic verification allows an attacker with physical w...
CVE-2026-50720: Improper Verification of Cryptographic Signature
The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...
CVE-2026-50720
The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...