Barebox CVE-2026-33243

Attacker with high-privilege local access to the barebox build system must modify the FIT (Flattened Image Tree) image file after signing but before deployment. Affects barebox versions 2016.03.0–2025.09.2 and 2025.10.0–2026.03.0. The hashed-nodes property in the FIT signature node can be altered to trick bootloader verification of different images.

The CVSS score of 8.2 (High) reflects significant impact with Changed scope, but real-world risk is constrained by the PR:H (High Privileges Required) and AV:L (Local Access) requirements. An attacker needs existing privileged access to the boot environment to modify FIT images before verification occurs. No EPSS score or KEV listing is provided in the intelligence, and no public proof-of-concept is explicitly mentioned, though a patch commit is publicly available at GitHub. The primary risk scenario involves supply chain attacks where an attacker with access to the image signing pipeline could create malicious images that bypass verification, or privilege escalation scenarios where a local attacker with existing root access seeks persistence through bootloader manipulation. While technically severe for secure boot bypass, the high privilege requirement significantly limits the attack surface compared to remotely exploitable vulnerabilities.

An attacker who has compromised a firmware build system or gained privileged access to embedded device storage could create a malicious FIT image containing unauthorized kernel or initramfs components. By modifying the hashed-nodes property to exclude the malicious components from verification while keeping legitimate signatures intact, the attacker tricks the barebox bootloader into loading the malicious payload as if it were properly signed. This enables persistent compromise surviving reboots and provides a foundation for secure boot bypass in industrial IoT devices, network appliances, or embedded systems using barebox.