Executive brief
Nordic Semiconductor's nRF bootloader (MCUboot) can incorrectly start the radio core using firmware from an unauthenticated slot when using Direct XIP update strategy. This occurs because the bootloader may select different storage slots for the main application and radio firmware without proper verification, allowing an attacker with access to modify the firmware storage to trigger execution of malicious radio firmware code.
Technical details
The vulnerability exists in MCUboot's Direct XIP update strategy implementation. When MCUboot determines that the system is bootable if at least one slot exists per image, it can select different slots for the main application and radio core firmware. The main application then starts the radio core using the address of the slot chosen by MCUboot, but without verifying that the radio image in that slot is authenticated. An attacker who can modify firmware images in the unauthenticated slot can cause execution of malicious code on the radio core. The attack requires local or physical access to modify firmware storage, but no user interaction or authentication is needed once the malicious image is in place.
Affected products
- Nordic Semiconductor nRF Bootloader
Timeline
- 2026-09-07: disclosed