BitBox discloses two severe hardware wallet vulnerabilities, fixed in firmware v9.26.5

Odaily Planet Daily News Bitcoin News stated on the X platform that BitBox has disclosed two severe hardware wallet vulnerabilities and noted that there is currently no evidence that these vulnerabilities have been exploited or resulted in user fund theft. All disclosed issues have been fixed in firmware v9.26.5, and BitBox urges all users to update immediately. An internal security audit identified two severe vulnerabilities, as well as new details regarding a previously fixed bootloader vulnerability. One of the vulnerabilities affecting BitBox Multi devices could allow a malicious host to execute arbitrary code and install malicious firmware on devices that have not yet completed setup. Another vulnerability in Silent Payments could allow an attacker to exploit a malicious host device to redirect funds to unintended addresses, causing Bitcoin to be locked and potentially enabling extortion attacks. BitBox also disclosed that the previously fixed bootloader vulnerability could allow attackers to induce users to install malicious firmware capable of stealing funds.