SWUpdate up to version 2026.05.1 performs CMS signature verification by trusting any X.509 certificate embedded within the CMS SignedData during chain building. This flaw allows an attacker who possesses a sibling intermediate signing key under the same root to embed that intermediate in the signature, causing SWUpdate to accept the update as legitimate. The impact is the execution of malicious updates on the target device, effectively compromising the system’s integrity and potentially allowing full control. The flaw is rated CVSS 9.2 for its severe impact and lack of requirement for further exploits.

The vulnerability affects the SWUpdate project maintained by sbabic. Devices running SWUpdate versions up to and including 2026.05.1 are impacted. Earlier or later releases may not contain the flawed code path, but the affected version list in the CNA data is limited to 2026.05.1.

The attack requires an attacker to possess a signing key from a sibling intermediate cert under the same root. Once such a key is available, the attacker can craft a CMS signature that bypasses validation and install a malicious update. This does not rely on a user interaction beyond installing the update, and no additional network-based exploitation is needed. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS and the potential for an entire firmware compromise translate to a high risk posture. Mitigation is therefore essential."