Technical impact
The Ingenic T31 SoC boot ROM contains a cryptographic validation flaw: it compares only a single 32‑bit word of the RSA signature with a single 32‑bit word of the SHA‑256 payload digest instead of verifying the full data. Consequently, an attacker who can write to the boot media can create a forged Secondary Program Loader (SPL) image that passes the incomplete check. Each forged image succeeds with an estimated probability of about two‑thirds, allowing repeated attempts until a signed image is accepted. This flaw permits an attacker to run arbitrary firmware on a device that thinks it is operating with genuine, vendor‑signed code.
Affected Systems
Devices that use the Ingenic T31 System‑on‑Chip, such as the Wyze Video Doorbell v2 (T31X), are affected. The vulnerability resides in the boot ROM’s flash‑boot verification path and applies to any equipment that relies on this chip for secure boot. No explicit software product versions or vendor patches are listed in the CNA data; the problem is intrinsic to the hardware firmware.
Risk and Exploitability
The EPSS score of <1% and the fact that the vulnerability is not listed in the CISA KEV catalog indicate that public reports of exploitation are currently limited. The CVSS score of 6.4 indicates a moderate severity. An attacker who gains physical access can replace the critical early boot code, potentially installing malware, gaining persistent control, or disabling device functionality. The impact is severe, affecting confidentiality, integrity, and availability of the entire system. The limited availability of information about any vendor fix or mitigation suggests the risk is high until a confirmed patch is applied.
