Swupdate
Monthly
Denial of service in SWUpdate (versions through 2025.12) allows unauthenticated remote attackers to crash the update service by sending a crafted HTTP POST to the /upload endpoint with a malformed multipart boundary and controlled TCP stream timing. An integer underflow in the bundled Mongoose multipart parser produces an out-of-bounds heap read that corrupts data written to a local IPC socket. No public exploit identified at time of analysis; EPSS is very low (0.03%) and CISA SSVC rates exploitation as none, but a vendor patch commit is available.
Local privilege escalation in SWUpdate versions before 2026.05 allows unprivileged users to gain root or install attacker-controlled content by winning a TOCTOU race during processing of a signed update. The flaw, reported by SBA Research and tracked as EUVD-2025-210052, undermines SWUpdate's signed-update integrity model on embedded Linux devices. No public exploit identified at time of analysis, but an upstream patch is available via commit f4bd6426.
Denial of service in SWUpdate (versions through 2025.12) allows unauthenticated remote attackers to crash the update service by sending a crafted HTTP POST to the /upload endpoint with a malformed multipart boundary and controlled TCP stream timing. An integer underflow in the bundled Mongoose multipart parser produces an out-of-bounds heap read that corrupts data written to a local IPC socket. No public exploit identified at time of analysis; EPSS is very low (0.03%) and CISA SSVC rates exploitation as none, but a vendor patch commit is available.
Local privilege escalation in SWUpdate versions before 2026.05 allows unprivileged users to gain root or install attacker-controlled content by winning a TOCTOU race during processing of a signed update. The flaw, reported by SBA Research and tracked as EUVD-2025-210052, undermines SWUpdate's signed-update integrity model on embedded Linux devices. No public exploit identified at time of analysis, but an upstream patch is available via commit f4bd6426.