CVE-2026-33243 - Vulnerability Analysis

Overview

barebox 2016.03.0 to < 2025.09.3 and 2025.10.0 to < 2026.03.1 contains a signature bypass caused by unhashed mutable hashed-nodes property in FIT signature node, letting attackers trick the bootloader into booting unverified images, exploit requires attacker to modify FIT image.

Severity & Score

Impact

Attackers can trick the bootloader into booting unverified images, potentially compromising system integrity and security.

Mitigation

Update to versions 2025.09.3 or 2026.03.1 or later.

References

• https://github.com/barebox/barebox/commit/aca01795056d51060cb096f9a1ea309361743e05
• https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 21, 2026

🟠 CVE-2026-33243 - High (8.2) barebox is a bootloader. In barebox from version 2016.03.0 to before version 2025.09.3 and from version 2025.10.0 to before version 2026.03.1, when creating a FIT, mkimage(1) sets the hashed-nodes property of the FIT signature node to list which n... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33243/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner