CVE-2026-50720

Name of the Vulnerable Software and Affected Versions Ingenic T31 SoC (affected versions not specified)

Description The boot ROM flash-boot verification path in the Ingenic T31 SoC incorrectly compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest instead of verifying the full data. This flaw allows an attacker with physical write access to boot media to forge modified SPL (Secondary Program Loader) images that bypass secure boot verification without the OEM signing key, with a success probability of approximately 2/3 per attempt. This issue was confirmed on the Wyze Video Doorbell v2 (T31X).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.