Ingenic T31 Boot ROM Improper Secure Boot Verification Bypass (CVE-2026-50720) with POC

Vulnerability Overview Vulnerability Name: Ingenic T31 Boot ROM — Improper Secure Boot Verification CVE ID: CVE-2026-50720 CVSS Score: 8.1 (High) Description: The boot ROM (mask ROM) of the Ingenic T31 SoC contains an implementation flaw when verifying the SPL (Secondary Program Loader) image. Due to an implementation error in the flash-boot verification path, the boot ROM compares only a single 32-bit word of the RSA-derived output against the SHA-256 payload digest, rather than the complete encrypted data. This reduces the effective security of the signature verification from 128 bits to 32 bits, allowing physical attackers to forge modified SPL images without possessing the OEM signing key. Affected Products Affected Products: - Ingenic T31 SoC series (all sub-variants), all known mask ROM revisions (T31, T31X, T31L, T31N, T31L, T31NO, etc.) - Wyze Video Doorbell v2 (based on T31X) used as a validation target Impact: - Complete bypass of first-stage boot security - Execution of arbitrary unsigned SPL and second-stage bootloader code - Firmware replacement possible without the OEM signing key - Persistence after factory reset — forged SPL images are stored in SPI NOR flash and re-executed on every boot - The vulnerability resides in the mask ROM and cannot be fixed via firmware updates Remediation Workarounds: - Physical Hardening: Restrict physical access to the device's boot media. Disable or physically remove any circuit programming interfaces (UART, JTAG, USB boot mode input). - eFuse-based Boot Media Locking: If the SoC/chip supports SPI-NOR write protection via eFuse or write protection pins, ensure it is enabled post-manufacturing. - Chain of Trust Monitoring: Verify the running kernel and user space from a separate trust element. - Replacement: For deployments requiring strict boot security, migrate to an SoC not affected by this vulnerability. Proof of Concept (POC) Code Additional Information Discoverers: Matt Davis (OpenSensor Engineering LLC) and Alfonso Gamboa Disclosure Timeline: - March 2026: Vulnerability discovered by Matt Davis and Alfonso Gamboa - March 17, 2026: Ingenic Semiconductor notified via multiple channels - March 17, 2026: Downstream vendor (Wyze) notified; coordination in progress - March 2026: Vulnerability confirmed via hardware demonstration on T31X device - March 25, 2026: CVE submitted to MITRE - May 30, 2026: Full technical details presented at Maine BSides - June 2026: CVE-2026-50720 assigned by MITRE References MITRE CVE-2026-50720 NVD entry OpenSensor Engineering — Security Disclosures OpenSensor — T31 Boot ROM Advisory Thingino Firmware Project CVE-2026-50719 — T32/T40/T41/A1 Init-Table Bypass (related, separate vulnerability class)

Goal Reached Thanks to every supporter — we hit 100%!

Ingenic T31 Boot ROM Improper Secure Boot Verification Bypass (CVE-2026-50720) with POC