CVE-2026-50719

Ingenic T41/T32/T40/A1 SoC boot ROMs execute an attacker-controlled init table from the SPL header before secure boot verification, using 32-bit writes to disable SRAM-resident secure boot state, allowing unsigned boot code. Hardware-validated on T41; ROM analysis confirms behavior on other chips...

Design/Logic Flaw

An unsafe configuration of nginx lead to information leak in Xiaomi router R3600 ROM before 1.0.50...

CVE-2020-14094

In Xiaomi router R3600, ROM version1.0.20, the connection service can be injected through the web interface, resulting in stack overflow or remote code execution...