CVE-2026-121606

Summary

The vulnerability allows remote attackers to bypass firmware signature verification by manipulating the 'sign' argument in the verify_sign function, enabling execution of untrusted firmware on affected devices.

Exploitability

Exploitation is straightforward and can be performed remotely without authentication or user interaction, as a public exploit exists.

Blast radius

Successful exploitation could lead to full device compromise, including arbitrary code execution, data exfiltration, and denial of service, especially in critical infrastructure or enterprise environments using these devices.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade affected devices to firmware version 6.4.10 or later, as no fixed version is explicitly named in the description beyond 'up to 6.4.9'. If upgrading is not immediately possible, disable firmware update functionality and restrict network access to the affected endpoints.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.