CVE•Published 2026-03-20•Modified 2026-09-11•1 article on news•5 live references•NVD data

CVE-2026-33243Pengutronix · Barebox

Vulnerability data via NVD (ingested)

CVSS v3.1

8.2

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS percentile

Exploit Prediction Scoring System · top 99% of all CVEs

Weaknesses (CWE)

CWE-345Insufficient Verification of Data Authenticity

Description

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and could therefore be modified to allow booting different images than those that have been verified. This issue has been patched in barebox versions 2026.03.1 and backported to 2025.09.3.

Timeline

Published 2026-03-20

Modified 2026-09-11

External references

NVD MITRE Exploit-DB GitHub PoC VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2026-33243

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product

product:"Pengutronix Barebox"

All exposed Pengutronix Barebox instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Barebox"

HTTP body or banner mentions "Barebox" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2026-33243