Ingenic T32/T40 Boot ROM Init-Table Bypass for Secure Boot Evasion (CVE-2026-50719)

Vulnerability Overview Vulnerability Name: Ingenic T32/T40/T41/A1 Boot ROM — Pre-Verification Init-Table Bypass CVE ID: CVE-2026-50719 CVSS Score: 8.1 (High) Vulnerability Description: The Boot ROM (Mask ROM) of the Ingenic T32, T40, T41, and A1 SoCs parses and executes an attacker-controlled table from the SPL (Secondary Program Loader) header before evaluating the secure boot state and invoking RSA-PSS signature verification. Since the table parser supports full 32-bit write addresses, an attacker can craft a SPI NOR boot media containing an SPL header that writes to the secure status in SRAM and clears the secure boot flags before the verification routine executes. The Boot ROM then skips signature verification and executes the unsigned SPL payload. Affected Scope Affected Products: Confirmed Affected (Hardware Verified, First Discovered): - Ingenic T32 SoC, all known Mask ROM revisions - Ingenic T40 SoC, all known Mask ROM revisions - Ingenic T41 SoC (including T41NQ), all known Mask ROM revisions - Consumer camera devices with secure boot enabled, based on T41NQ Analyzed as Affected (Expected, not yet first hardware verified): - Ingenic A1 SoC — ROM analysis confirms the identical table parser and pre-verification execution order Impact: Full bypass of secure boot on T32, T40, and T41 (Hardware Verified, First Discovered) Potential full bypass of secure boot on A1 (Analysis Only) Execution of arbitrary unsigned SPL and second-stage bootloader code Complete firmware replacement without OEM signature keys Persistence across factory resets — the patched SPL image is stored in SPI NOR flash and re-executed on every boot Vulnerability exists in the Mask ROM, making it unfixable via firmware updates Remediation Workarounds: Since the vulnerability resides in the Mask ROM, there are no firmware-only field mitigations. For deployed fleets, actual risk reduction options include: Physical Hardening: Restrict physical access to the device's boot media. Disable or physically remove any programming interfaces present on the circuit (e.g., UART, JTAG, USB boot mode entry points). eFuse Boot Media Lock: If the SoC/chip supports SPI-NOR write protection via eFuse or write-protect pins, ensure this is enabled after manufacturing. Replacement: For deployments requiring secure boot, migrate to SoCs that do not have this vulnerability. POC Code Additional Information Disclosure Timeline: March 2026: Vulnerability discovered by Matt Davis and Alfonso Gamboa March 2026: First hardware verification on T32, T40, and T41 silicon March 17, 2026: Ingenic Semiconductor notified via multiple channels March 17, 2026: Downstream vendor (Wyze) notified, coordination ongoing March 25, 2026: CVE submitted to MITRE (7-day early submission, justified due to unpatchable Mask ROM) May 30, 2026: Full technical details presented at Maine BSides June 2026: CVE-2026-50719 assigned by MITRE Credits: Discovered jointly by Matt Davis (OpenSensor Engineering LLC) and Alfonso Gamboa Content editing and report validation by Josh at WLTechBlog References: MITRE CVE-2026-50719 NVD Entry OpenSensor Engineering — Security Disclosure OpenSensor — T41 Init-Table Bypass Advisory Thingino Firmware Project CVE-2026-50720 — T31 Partial Verification (Related, separate vulnerability class)

Goal Reached Thanks to every supporter — we hit 100%!

Ingenic T32/T40 Boot ROM Init-Table Bypass for Secure Boot Evasion (CVE-2026-50719)