Swupdate
Monthly
Malicious firmware updates can be installed on devices running SWUpdate through 2026.05.1 due to improper validation of X.509 certificates embedded in CMS SignedData, allowing an attacker with a signing key from a sibling intermediate CA under the same trusted root to bypass signature verification. The vulnerability is present in default builds and requires no user interaction or device privileges, but exploitation is limited to environments where the trusted root has multiple intermediate CAs. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in SWUpdate (versions through 2025.12) allows unauthenticated remote attackers to crash the update service by sending a crafted HTTP POST to the /upload endpoint with a malformed multipart boundary and controlled TCP stream timing. An integer underflow in the bundled Mongoose multipart parser produces an out-of-bounds heap read that corrupts data written to a local IPC socket. No public exploit identified at time of analysis; EPSS is very low (0.03%) and CISA SSVC rates exploitation as none, but a vendor patch commit is available.
Local privilege escalation in SWUpdate versions before 2026.05 allows unprivileged users to gain root or install attacker-controlled content by winning a TOCTOU race during processing of a signed update. The flaw, reported by SBA Research and tracked as EUVD-2025-210052, undermines SWUpdate's signed-update integrity model on embedded Linux devices. No public exploit identified at time of analysis, but an upstream patch is available via commit f4bd6426.
Malicious firmware updates can be installed on devices running SWUpdate through 2026.05.1 due to improper validation of X.509 certificates embedded in CMS SignedData, allowing an attacker with a signing key from a sibling intermediate CA under the same trusted root to bypass signature verification. The vulnerability is present in default builds and requires no user interaction or device privileges, but exploitation is limited to environments where the trusted root has multiple intermediate CAs. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in SWUpdate (versions through 2025.12) allows unauthenticated remote attackers to crash the update service by sending a crafted HTTP POST to the /upload endpoint with a malformed multipart boundary and controlled TCP stream timing. An integer underflow in the bundled Mongoose multipart parser produces an out-of-bounds heap read that corrupts data written to a local IPC socket. No public exploit identified at time of analysis; EPSS is very low (0.03%) and CISA SSVC rates exploitation as none, but a vendor patch commit is available.
Local privilege escalation in SWUpdate versions before 2026.05 allows unprivileged users to gain root or install attacker-controlled content by winning a TOCTOU race during processing of a signed update. The flaw, reported by SBA Research and tracked as EUVD-2025-210052, undermines SWUpdate's signed-update integrity model on embedded Linux devices. No public exploit identified at time of analysis, but an upstream patch is available via commit f4bd6426.