Executive brief
Northern.tech Mender Client, a tool used to manage over-the-air (OTA) software updates for IoT and embedded devices, contains a flaw in how it verifies digital signatures. An attacker could potentially bypass security checks to inject malicious files into a software update. If successful, this could allow an attacker to take full control of the affected device, though the risk is mitigated if using the standard Mender Server and default update modules.
Technical details
A vulnerability in the signature verification logic of Mender Client (versions 5.0.0 through 5.0.3) allows an attacker to append additional files to a Mender Artifact without invalidating the cryptographic signature. The root cause is that the client may skip verification for files included in the artifact payload that are not explicitly listed with a checksum in the update manifest. While the default update modules (rootfs, directory, single file) and the standard Mender Server are not susceptible to this exploit, custom update modules that process unexpected files or custom delivery mechanisms that bypass server-side validation could allow an attacker to achieve remote code execution or device takeover. The issue is resolved in Mender Client version 5.0.4 and 6.0.0.
Affected products
- Northern.tech Mender Client 5.0.0 to 5.0.3
Timeline
- 2026-05-27: disclosed: Disclosed via HackerOne bug bounty program
- 2026-05-27: patched: Fixed in version 5.0.4 and 6.0.0
- 2026-05-27: advisory