EUVD-2026-70367
GHSA-9whx-x3gf-f75p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain physical device access
-
DeliveryAttach serial/debug adapter to hardware interface
-
ExploitAccess bootloader console unauthenticated
-
ExecutionExecute arbitrary bootloader commands
-
PersistRead or overwrite device firmware
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Physical access to the ShizenBox2 hardware is the sole prerequisite - no network path, no credentials, and no special software are required. The vulnerability is specific to the 'dev-conf' firmware variant (versions ≤v1.0.10); production firmware builds may not expose bootloader interfaces in the same way. Once physical contact with the device is established, bootloader command execution requires no authentication whatsoever (PR:N in the CVSS vector). Exploitation is structurally limited to: physical proximity to a deployed device, access to the device's hardware debug interface (e.g., exposed UART pads or headers), and possession of basic electronics tooling. Remote network-based exploitation is not possible. |
| Impact | The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) precisely scopes the risk: exploitation requires physical proximity to the device, which fundamentally caps the threat to insider threats, device theft, supply-chain interdiction, or physical break-in scenarios. The score of 7.0 reflects full CIA impact once physical access is obtained, but the physical access requirement (AV:P) means the vast majority of network-based attackers are excluded. EPSS data is not available in the provided intelligence. No KEV listing exists, confirming no observed widespread exploitation. The 'dev-conf' label raises the question of whether this variant appears in production deployments at all - if it is a development/testing build only, real-world exposure may be narrower than the CPE wildcard implies. No conflicting signals present; the AV:P vector and CWE-1263 are internally consistent with the description. |
| Exploit ScenarioDerived | An attacker gains hands-on access to a ShizenBox2 (dev-conf) device - for example through theft, insider access, or supply-chain interception during shipping - and attaches a USB-to-UART adapter to the device's debug serial pins. With no authentication prompt, the bootloader console accepts commands directly, allowing the attacker to read or overwrite firmware, extract credentials stored in flash, or install a backdoored firmware image for persistent control. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 03, 2026
Unauthenticated bootloader command execution in ShizenBox2 (dev-conf) firmware ≤v1.0.10 is achievable by any attacker with physical access to the device. The 'dev-conf' firmware variant from Shizen Connect Inc. fails to enforce authentication on bootloader interfaces (CWE-1263), exposing full device control - including firmware manipulation - without credential verification. Reported through JPCERT/JVN responsible disclosure; no public exploit code identified and no CISA KEV listing at time of analysis.
Earlier versions of this analysis (1)
Unauthenticated bootloader command execution on ShizenBox2 (dev-conf) devices is possible for any attacker with physical access to the hardware. Classified under CWE-1263 (Improper Physical Access Control), the device exposes its bootloader interface without enforcing any authentication challenge, enabling full device compromise including firmware extraction, data dump, and persistent modification. Reported by JPCERT and documented in JVN#91715694; no public exploit identified at time of analysis, though physical bootloader access requires only commodity terminal tooling once proximity is achieved.
RemediationAI
No vendor-released patch version is independently confirmed from the available input data; consult the vendor advisory PDF at https://www.se-digital.net/wp-content/uploads/2026/08/CVE-2026-80253.pdf and the JVN entry at https://jvn.jp/en/jp/JVN91715694/ for firmware update guidance. As an immediate compensating control, restrict physical access to all ShizenBox2 devices by deploying them in physically secured enclosures, locked server rooms, or access-controlled cabinets - this directly addresses the AV:P attack vector. Operators should audit whether 'dev-conf' firmware variants are deployed in production environments and replace them with production firmware builds if available, as development configurations typically retain debug interfaces by design. Tamper-evident seals on device enclosures can provide detection capability for physical access attempts.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ShizenBox2 is an IoT/edge device produced by Shizen Connect Inc. The 'dev-conf' designation identifies a development-configuration firmware variant, which typically retains debug interfaces (commonly UART serial console, JTAG, or similar low-level hardware interfaces) that expose bootloader access. CWE-1263 (Improper Physical Access Control) covers precisely this class of flaw: a device fails to gate bootloader or debug interfaces behind authentication, allowing anyone who can physically connect to the hardware to interact with the bootloader shell. The CPE string cpe:2.3:a:shizen_connect_inc.:shizenbox2_(dev-conf):*:*:*:*:*:*:*:* confirms all sub-versions of the dev-conf variant are potentially in scope, with the EUVD bounding affected versions at ≤v1.0.10.
Know when Shizenbox2 Dev Conf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Physical access required (AV:P), no authentication on bootloader interface (PR:N), full CIA impact on the device attainable once physical access is obtained.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
3DescriptionCVE.org
An improper physical access control issue exists in ShizenBox2 (dev-conf). If exploited, an attacker with physical access to the product may execute bootloader commands without authentication.
Executive ViewAI
ShizenBox2 devices running dev-conf firmware version 1.0.10 and earlier allow unauthenticated bootloader command execution to any person with physical device access, enabling complete firmware manipulation and device takeover. Organizations deploying this development firmware variant face risk of unauthorized system modification if devices are accessible in office, lab, or field environments.
No vendor-released patch identified at time of analysis. Implement physical access controls and device enclosure security to restrict unauthorized hands-on access. Monitor and log bootloader access if supported by the device. Isolate vulnerable dev-conf systems from uncontrolled or high-risk physical environments. Document all personnel with legitimate physical access to these devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB