The Ingenic T31 SoC boot ROM contains a cryptographic validation flaw: it compares only a single 32‑bit word of the RSA signature with a single 32‑bit word of the SHA‑256 payload digest instead of verifying the full data. Consequently, an attacker who can write to the boot media can create a forged Secondary Program Loader (SPL) image that passes the incomplete check. Each forged image succeeds with an estimated probability of about two‑thirds, allowing repeated attempts until a signed image is accepted. This flaw permits an attacker to run arbitrary firmware on a device that thinks it is operating with genuine, vendor‑signed code.

Devices that use the Ingenic T31 System‑on‑Chip, such as the Wyze Video Doorbell v2 (T31X), are affected. The vulnerability resides in the boot ROM’s flash‑boot verification path and applies to any equipment that relies on this chip for secure boot. No explicit software product versions or vendor patches are listed in the CNA data; the problem is intrinsic to the hardware firmware.

The lack of an EPSS score and the absence of a KEV listing indicate that public reports of exploitation are currently limited, but the inherent probability of success (≈67 %) and requirement for physical access to the boot media give this flaw a high exploitation probability in environments where the device enclosure can be tampered with. An attacker who gains such physical access can replace the critical early boot code, potentially installing malware, gaining persistent control, or disabling device functionality. The impact is severe, affecting confidentiality, integrity, and availability of the entire system. The limited availability of information about any vendor fix or mitigation suggests the risk is high until a confirmed patch is applied.