SWUpdate: Improper certificate validation in CMS signature verification
Summary
SWUpdate, an update agent for embedded Linux systems, through version 2026.05.1 trusts X.509 certificates embedded in CMS-signed update packages when it builds the certificate chain. An attacker holding a signing key from a sibling intermediate CA under the same root can embed that intermediate in the signature and install malicious updates. The attack requires such a key, so an outsider without it should not be able to exploit this.
Affected
- SWUpdate versions 0 through 2026.05.1 (according to the CVE record and the linked vendor code).
- Default configuration is unaffected according to the CVE record.
Fixed in
- According to a secondary summary, version 2026.05.2 or later. Not verified against the vendor release page.
Workaround
- No vendor-documented workaround.
- Interim measures (own assessment, not from a source): restrict who can push update packages to devices, keep the update channel on a trusted network, and limit which intermediate CAs are trusted under the signing root.
Exploitation
- Not known to be exploited in the wild. CISA SSVC lists exploitation as none and automatable as no.
- No public proof of concept found. This means nothing is known, not that no exploit exists.
Our recommendation
- Inventory all SWUpdate-based devices, firmware and images, including Yocto or Buildroot builds.
- If none exist, this CVE is low priority.
- If they exist, plan an upgrade to 2026.05.2 or later once the vendor confirms a fixed build, and ask device suppliers for a fixed version.
- Review how signing keys and intermediate CAs are managed and restrict who can distribute updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- SWUpdate GitHub repository github.com
- swupdate_cms_verify_openssl.c at 2026.05.1 github.com
- Fix commit e66c5640 github.com
- VulnCheck advisory www.vulncheck.com
- Ubuntu security notice CVE-2026-109399 ubuntu.com
- VulDB entry 416970 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:44.
Original description (NVD)
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.
NVD references (5)
- https://github.com/sbabic/swupdate
- https://github.com/sbabic/swupdate/blob/2026.05.1/crypto/swupdate_cms_verify_openssl.c
- https://github.com/sbabic/swupdate/commit/e66c5640664a31668926a24c0c84b6b6570dc0d9
- https://groups.google.com/g/swupdate/c/dsoMcGFnEns
- https://www.vulncheck.com/advisories/swupdate-through-2026.05.1-cms-signature-verification-bypass-via-embedde…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.