SWUpdate EUVD-2026-97496

Exploitation requires the attacker to possess a valid signing key and certificate from a sibling intermediate CA that chains to the SAME root CA already trusted by the target SWUpdate device - i.e., a legitimately-issued intermediate within the same PKI hierarchy. The vulnerable behavior is present in default builds (versions through 2026.05.1) where additional X.509 certificates embedded in CMS SignedData are trusted for chain building; the fix adds a CMS_IGNORE_ADDITIONAL_CERTS option to use only direct signer certificates. Key LIMITING factors: no exploitation is possible without that sibling-intermediate key (the AT:P / AC:H prerequisite), and deployments using a single-issuer PKI with no sibling intermediates under the trusted root are not realistically exploitable. No user interaction or device privileges are required once the signed malicious image is delivered.

This is a genuine integrity/supply-chain risk but with meaningful preconditions that temper the 9.2 CVSS 4.0 score. The vector (AV:N/AC:H/AT:P/PR:N/UI:N) is internally consistent with the description: no privileges on the target device and no user interaction are needed (PR:N/UI:N), but both AC:H and AT:P correctly reflect the hard prerequisite - the attacker must already hold a signing key/certificate from a sibling intermediate CA under the SAME root the device trusts. This is not opportunistic mass exploitation; it is a targeted PKI-abuse scenario. No EPSS score was provided and the CVE is NOT in CISA KEV, so there is no confirmed active exploitation - status is 'no public exploit identified at time of analysis' (a vendor patch commit is public, but a patch diff is not a weaponized POC). The signals are therefore coherent rather than conflicting: high technical impact (full malicious-firmware install → VC/VI/VA:H) but gated behind a non-trivial trust-hierarchy precondition. Net: a real priority for organizations running multi-tenant or multi-vendor PKI where sibling intermediates exist under a shared root, but lower real-world urgency for single-issuer deployments. Note the input 'Information Disclosure' tag mischaracterizes the flaw, which is primarily an integrity/code-integrity bypass enabling malicious updates.

An attacker who legitimately holds a signing certificate issued by a sibling intermediate CA chained to the same root CA the device trusts crafts a malicious SWUpdate image, signs it with their key, and embeds their intermediate certificate inside the CMS SignedData. Because SWUpdate trusts the embedded certificate for chain building, verification succeeds and the malicious update is installed. No public exploit code was identified at time of analysis, though the fixing commit is public.