Improper Certificate Validation in SWUpdate

hello@craftedsignal.io — Mon, 12 Oct 2026 18:34:05 +0000

SWUpdate, an update agent for embedded Linux devices, contains a critical vulnerability (CVE-2026-109399) within the crypto/swupdate_cms_verify_openssl.c source file. The vulnerability arises from improper certificate validation during the verification of CMS SignedData. Specifically, the implementation erroneously trusts untrusted X.509 certificates that are embedded directly within the signature for the purpose of chain building.

This flaw allows an attacker who possesses a valid signing key from a sibling intermediate certificate (issued by the same root CA as the legitimate update server) to craft a malicious update package. By embedding the compromised sibling intermediate certificate into the CMS SignedData, the attacker can force the SWUpdate verification logic to accept the malicious package as authentic. This allows the delivery and installation of arbitrary, potentially malicious update binaries on the target embedded device. Organizations using SWUpdate to manage remote firmware updates should prioritize patching or implementing strict signature verification controls.

SWUpdate - CraftedSignal Threat Feed

Improper Certificate Validation in SWUpdate