Read the docs
TI-2026-25661 Aliases CVE-2026-33243

barebox: FIT Signature Verification Bypass Vulnerability

Priority LOW 37CWE-345Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and could therefore be modified to allow booting different images than those that have been verified. This issue has been patched in barebox versions 2026.03.1 and backported to 2025.09.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00114 1st percentileScored 2026-11-07
Fix Fixed barebox (barebox): 2025.09.3, 2026.03.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bareboxbarebox2016.03.0 to before 2025.09.3; 2025.10.0 to before 2026.03.12025.09.3, 2026.03.1Patch availableCNA
  • barebox Vendorbarebox Affected 2016.03.0 to before 2025.09.3; 2025.10.0 to before 2026.03.1 Fixed in 2025.09.3, 2026.03.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pengutronix:barebox:*:*:*:*:*:*:*:*2016.03.0 to before 2025.09.3; 2025.10.0 to before 2026.03.1Vulnerablebarebox
  • cpe:2.3:a:pengutronix:barebox:*:*:*:*:*:*:*:* Versions 2016.03.0 to before 2025.09.3; 2025.10.0 to before 2026.03.1 Vulnerable ·barebox

Remediation

  • Fix · CNA barebox (barebox) Fixed in 2025.09.3, 2026.03.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33243

References

Patch 2

  • TI-2019-11982 Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in… CVSS 3.0CRITICAL 9.8
  • TI-2019-11981 Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply… CVSS 3.0CRITICAL 9.8
  • TI-2020-10888 Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in… CVSS 3.1CRITICAL 9.1
  • TI-2026-27185 barebox EFI PE Loader Memory Safety Vulnerabilities CVSS 4.0HIGH 8.6
  • TI-2021-15656 common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information… CVSS 3.1HIGH 7.5
  • TI-2021-15655 crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because… CVSS 3.1HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences