CVE-2024-13942
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack when booting from external media (SPI NOR or NAND, EMMC or SD). The code reads the header of the next-stage loader twice; the first read is partial and contains only hashes of executable modules, the second is complete including signature. Authenticity of modules is checked against partial data from the first read, allowing an attacker with physical access to modify data and execute arbitrary code with highest privileges (EL3).
Risk Assessment
An attacker with physical access to the device can gain full control over the system, leading to complete compromise of the device.
Recommendation
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Related vulnerabilities
- CVE-2026-120213Critical
@fastify/http-proxy versions 9.0.0 through 11.6.5 substitute URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value encoding a path separator with a fragment or query delimiter decodes into real separators, injecting extra upstream path segments and stripping the mandatory suffix. An unauthenticated remote attacker can reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, SSRF or authorization bypass.
- CVE-2026-120345Critical
A vulnerability was found in the WAVLINK WN551X3-A device, affecting the sub_41a430 function in /bin/ioos within the DNS Resolution Handler component. Manipulating the data argument results in OS command injection, and the attack can be launched remotely. The exploit has been made public and could be used.
- CVE-2025-11969Critical
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. APIs exposed through the WSO2 API Manager's API Gateway are not affected.
- CVE-2026-120344Critical
A vulnerability was found in the WAVLINK WN551X3-A device in the system function of /bin/ioos, within the WireGuard CLI Group Handler component. Manipulating the group_name argument leads to OS command injection, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-120322Critical
A vulnerability was identified in Termix-SSH Termix up to 2.9.2 affecting the /plugin-api/file-manager/transferToHost endpoint. Manipulation of the destPath argument leads to path traversal, and the attack can be launched remotely. The exploit is publicly available and may be used.
- CVE-2026-120283Critical
A vulnerability was identified in Linksys E8450 version 1.2.00.360516 in the strcpy function of /www/cgi-bin/portal.cgi. Manipulation of the hidden_timezone argument leads to a stack-based buffer overflow. The attack can be executed remotely, and the vendor did not respond to the disclosure.
- CVE-2026-120282Critical
A vulnerability was determined in WAVLINK WN536AX6-A version V260507 in the host_black function of /protocol.csp. Manipulation of the mac argument causes OS command injection. The exploit has been publicly disclosed and remote exploitation is possible.
- CVE-2026-120281Critical
A vulnerability was found in WAVLINK WN536AX6-A version V260507 in the OpenVPN Handler component, in the strcpy function of /protocol.csp. Manipulation of the openvpn_ip argument results in a stack-based buffer overflow. The exploit has been made public and the attack may be launched remotely.
- CVE-2026-120280Critical
A vulnerability has been found in WAVLINK WN536AX6-A version V260507 in the WireGuard component, in the wireguard_cli_group handler of /protocol.csp. Manipulation of the group_id/group_name arguments leads to OS command injection. The exploit has been disclosed publicly and the attack may be initiated remotely.
- CVE-2026-120279Critical
A flaw has been found in WAVLINK WN536AX6-A version V260507 in the openvpn_cli Handler component, in an unknown function of /protocol.csp. Manipulation of the file_id argument can lead to OS command injection. The exploit has been published and the attack can be launched remotely.
Original NVD description (English source)
Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media (SPI NOR or NAND, EMMC or SD). The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key, the public part of which is verified against the SHA256 digest blown in the OTP. The first read is only partial and contains only the hashes of the executable modules. The second is complete, including the header signature. Although the header is verified based on the fully read data, the authenticity of the executable modules is checked against the partial data from the first read. An attacker with physical access to a device containing RK3588s SoC can easily modify the next-stage loader data on-the-fly using a low-cost SD-card or SPI NOR/NAND or EMMC emulator. Even a simple ultra low-cost circuit comprising two memory chips (containing the same data but different headers - the original and the modified one) and a multiplexer can be used to carry out an attack. This can lead to arbitrary code execution with the highest privileges available (EL3). This issue affects RK3588s: RK3588s SoC BootROM (secure) 350B20210512V100 and possibly others. As remediation apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable https://www.rock-chips.com/a/en/products/RK35_Series/2022/0926/1660.html
Vulnerability data from NVD (NIST) · CISA KEV · EPSS