Northern.tech Mender Client versions prior to 5.0.4 contain a cryptographic signature verification bypass vulnerability (CWE-347). This weakness allows an attacker to bypass the verification process that ensures the authenticity of updates or data, potentially permitting unauthorized code or data to be accepted by the client. The vulnerability is remotely exploitable without privileges or user interaction, with a CVSS base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No official remediation or patch information is currently provided.

The vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to acceptance of unauthorized or malicious updates. The impact is limited to a confidentiality loss with no direct integrity or availability impact reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Northern.tech advisories for updates and consider restricting update sources or applying additional verification controls where possible.