The Ingenic T41 SoC boot ROM parses and executes an attacker-controlled init table from the SPL header prior to checking the secure boot state and signature verification. The init table parser supports full-address 32-bit write operations, which can be exploited to modify the SRAM-resident secure boot state before the verification decision is made. An attacker with physical write access to the boot media can inject an init-table entry that disables the secure boot check, causing the ROM to accept unsigned or modified first-stage boot code. This vulnerability has been hardware-validated on a secureboot-enabled T41 device, and ROM analysis indicates similar behavior on T32, T40, and A1 SoCs.

An attacker with physical write access to the boot media can bypass secure boot protections by injecting malicious init-table entries that disable secure boot checks. This allows execution of unsigned or tampered first-stage boot code, potentially compromising the device's trust chain and enabling persistent low-level compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict physical access to devices and boot media to prevent unauthorized modification of the init table.