The vulnerability allows an attacker who can physically write to the device’s boot media to inject a specially crafted init‑table entry. This entry is parsed and executed by the Ingenic T41, T32, T40, and A1 SoC boot ROM before the system state is verified for secure boot. By performing a full‑address 32‑bit write, the attacker can alter the SRAM‑resident secure boot flag, effectively disabling the signature verification and permitting the ROM to load unsigned or modified first‑stage boot code. The result is a complete bypass of the device’s trusted boot chain, allowing execution of arbitrary firmware that can threaten confidentiality, integrity, or availability.

The affected systems are Ingenic SoCs including the T41, T32, T40, and A1 families. While the vendor is not listed as a known CNA provider, the security note explicitly references that the flaw is present in the boot ROM of these devices. No specific firmware versions are provided, so any device running the default boot ROM is potentially vulnerable.

The flaw requires physical write access to boot media, limiting the attacker to environments where firmware can be modified, such as during manufacturing or by a malicious insider. Because EPSS data is unavailable and the vulnerability is not listed in CISA KEV, publicly available exploit data is scarce, but the impact of disabling secure boot is substantial. An attacker can replace the first‑stage boot image with malicious firmware, compromising confidentiality, integrity, and availability of the device. The flaw falls under CWE‑287, indicating an authentication bypass vulnerability.