Ingenic T31 SoC CVE-2026-50720

Exploitation requires physical write access to the boot media (NAND flash, eMMC, or SD card) of an Ingenic T31-based device - this is the absolute prerequisite and cannot be circumvented remotely. The flash-boot verification path must be the active boot mode on the target device; devices booting exclusively from paths not subject to this ROM verification would not be affected. The attacker must be capable of constructing a syntactically valid forged SPL; due to the ~2/3 per-attempt success rate, typically one or two write-and-boot cycles suffice, requiring no cryptographic key material. No software authentication credentials, network access, or OS-level privileges are required. Exploitation is limited to actors who can obtain physical custody of target hardware, making supply chain interception, insider threat, or theft of deployed devices the primary threat vectors. The CVSS PR:N rating reflects the absence of software-level privilege requirements, not an absence of access barriers.

CVSS AV:P correctly limits the threat surface to actors with physical access to boot media, ruling out remote or network exploitation entirely - the EPSS score of 0.15% at the 5th percentile accurately reflects this constraint. AC:H captures the specialized knowledge required to reverse-engineer the T31 boot ROM and construct a valid forged SPL, though the ~2/3 per-attempt success rate means the cryptographic forgery step itself is nearly trivial once that expertise is applied. CIA impact is correctly rated H/H/H because successful exploitation yields unsigned firmware execution at the earliest boot stage, below any OS-level security control. This vulnerability is not in CISA KEV and EPSS is low, but organizations operating fleets of T31-based IoT cameras should not dismiss it on CVSS score alone - supply chain interception, shipping custody gaps, and unsecured physical installations are realistic threat vectors for networked camera deployments. The CPE field in available structured data is 'n/a', meaning the affected product scope beyond the confirmed T31X cannot be formally bounded; other Ingenic T31 SKUs (T31L, T31A, T31N) sharing the same boot ROM should be treated as potentially affected pending vendor clarification. EUVD tags ('JWT Attack', 'Information Disclosure') are clearly erroneous enrichment for this vulnerability and should be disregarded in any risk characterization.

An attacker who obtains brief physical custody of a deployed T31-based IP camera - during shipping, a maintenance window, or via access to an unsecured installation - removes or directly accesses the boot media, writes a modified SPL image containing a persistent backdoor, and returns the device to service. On next boot, the ROM compares only 4 bytes of the RSA signature output against 4 bytes of the digest; with ~2/3 probability the forged image passes, executing unsigned attacker-controlled firmware - typically succeeding within one or two attempts. The malicious firmware runs persistently below the OS, surviving factory resets, and may exfiltrate video feeds or enable lateral movement into the local network.