{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/swupdate--2026.05.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:swupdate:swupdate:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-109399"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SWUpdate (\u003c= 2026.05.1)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","firmware-security","supply-chain"],"_cs_type":"threat","_cs_vendors":["SWUpdate"],"content_html":"\u003cp\u003eSWUpdate, an update agent for embedded Linux devices, contains a critical vulnerability (CVE-2026-109399) within the crypto/swupdate_cms_verify_openssl.c source file. The vulnerability arises from improper certificate validation during the verification of CMS SignedData. Specifically, the implementation erroneously trusts untrusted X.509 certificates that are embedded directly within the signature for the purpose of chain building.\u003c/p\u003e\n\u003cp\u003eThis flaw allows an attacker who possesses a valid signing key from a sibling intermediate certificate (issued by the same root CA as the legitimate update server) to craft a malicious update package. By embedding the compromised sibling intermediate certificate into the CMS SignedData, the attacker can force the SWUpdate verification logic to accept the malicious package as authentic. This allows the delivery and installation of arbitrary, potentially malicious update binaries on the target embedded device. Organizations using SWUpdate to manage remote firmware updates should prioritize patching or implementing strict signature verification controls.\u003c/p\u003e\n","date_modified":"2026-10-12T18:34:05Z","date_published":"2026-10-12T18:34:05Z","id":"https://feed.craftedsignal.io/briefs/2026-10-swupdate-cert-validation/","summary":"SWUpdate through 2026.05.1 is vulnerable to certificate validation bypass in crypto/swupdate_cms_verify_openssl.c, allowing attackers to sign and install malicious update packages.","title":"Improper Certificate Validation in SWUpdate","url":"https://feed.craftedsignal.io/briefs/2026-10-swupdate-cert-validation/"}],"language":"en","title":"CraftedSignal Threat Feed - SWUpdate (\u003c= 2026.05.1)","version":"https://jsonfeed.org/version/1.1"}