ps5-uart

24 pin header near salina EDM-010 root@kitploit: emc header 1 5v 2 5v 3 gnd 4 gnd 5 emc gpio a1. pulling low at emc boot causes emc rom to enter uart shell @ 460800 6 uart rx emc 115200 7 uart tx emc 115200 8 3v3, goes low when emc resets 9 0v? 10 gnd 11 titania uart0 tx efc fw: 460800, eap fw:...

fusee-gelee

fusee-gelee An implementation of the Fusee Gelee exploit CVE-2018-6242 for the Nintendo Switch, based on the vulnerability disclosed by Kate Temkin / ReSwitched in March 2018. Launches an arbitrary payload e.g. hekate on a Tegra X1 device in USB Recovery Mode RCM, bypassing the boot ROM's signatu...

CVE-2024-56426

SM-G985F / Exynos9830 Bootrom exploit !CAUTION The current key bundle and generated files are fusing-capable. Once a device has been fused, the eFuse change is irreversible and the device must continue to use boot images and key material that match the fused key. Using these files or flows is at...

am335xbootrom

Reverse Engineering the AM335x Boot ROM It's probably been eighteen months since I first got my hands a few Beaglebone Black boards, saved from the dumpster. Unfortunately, the boards didn't work right away. Now, this was my first time working with one of these boards, or any single board compute...

CVE-2026-50720

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...

EUVD-2026-62479

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing...

CVE-2026-50719

The Ingenic T41 SoC boot ROM (and likely T32, T40, and A1 ) parses and executes an attacker-controlled init table from the SPL header before performing any secure boot state check or signature verification. Because the init table parser supports full-address 32-bit write operations , an attacker ...

EUVD-2026-28232

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow,...

Microsoft Xbox One Hacked

It's an impressive feat, over a decade after the box was released: Since reset glitching wasn't possible, Gaasedelen thought some voltage glitching could do the trick. So, instead of tinkering with the system rest pins the hacker targeted the momentary collapse of the CPU voltage rail. This was...

EUVD-2021-13172

Malware in sbrugna...

EUVD-2022-41265

Malicious code in bioql PyPI...

EUVD-2022-41261

Malicious code in bioql PyPI...

CVE-2022-38695

In BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privileges needed...

CVE-2022-38692

In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation. This could lead to memory buffer overflow without requiring additional execution privileges...

CVE-2022-23005

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...

SUSE CVE-2021-26315

When the AMD Platform Security Processor PSP boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of the integrity of decrypted image, arbitrary code may be executed in the PSP when encrypted firmware images are used...

CVE-2022-23005

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...

Security feature bypass

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...

CVE-2022-23005 Host Boot ROM Code Vulnerability in Systems Implementing UFS Boot Feature

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...

CVE-2022-23005 Host Boot ROM Code Vulnerability in Systems Implementing UFS Boot Feature

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...