CVE-2026-109399

The SWUpdate software (versions through 2026.05.1 ) is vulnerable to a CMS Signature Verification Bypass due to an improper certificate validation flaw in crypto/swupdate_cms_verify_openssl.c. The root cause is that the system trusts untrusted X.509 certificates embedded within CMS SignedData dur...