CVE-2026-50720: n/a

CVE-2026-50720 describes a cryptographic verification flaw in the Ingenic T31 SoC boot ROM. Instead of verifying the full RSA signature against the full SHA-256 digest of the payload, the boot ROM compares only a single 32-bit word from each. This weak comparison enables attackers with physical write access to the boot media to create forged SPL images that pass secure boot verification without needing the OEM's signing key. The vulnerability has been confirmed by reverse engineering, emulation against vendor-signed images, and successful hardware acceptance of forged firmware on a Wyze Video Doorbell v2 device.

An attacker with physical access to the boot media can bypass secure boot protections by forging modified SPL images that are accepted as authentic by the boot ROM. This compromises the device's chain of trust, potentially allowing arbitrary code execution at boot, leading to full device compromise. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector. The attack requires physical access and has a high probability of success (approximately 2/3 per attempt).

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, physical access to boot media should be strictly controlled to mitigate exploitation risk.