Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-5818

MCU Firmware Update Authentication Bypass on Caliptra Core

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Caliptra

Description

Incorrect check of function return value in Caliptra Core Runtime Firmware (ActivateFirmwareCmd::activate_fw modules) allows bypass of Caliptra Core's verification of the MCU FW during a hitless update. This issue affects Core Runtime Firmware: from 2.0.0 through 2.0.1, 2.1.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Caliptra Core Runtime Firmware

Default version status: unaffected

  • 2.0.0 to ≤ 2.0.1affected
  • 2.1.0affected
  • 2.0.2unaffected
  • 2.1.1unaffected

References