CVE-2026-36433
Arbitrary Code Execution in Actions Semiconductor Media Player Utilities v.4.46

Description

Actions Semiconductor Media Player Utilities v.4.46 contains a critical vulnerability in its firmware update mechanism. The update toolchain — composed of Production.dll and RdiskUpgrade.exe — performs no cryptographic validation of firmware images before writing them to the device. An attacker with approximately 60 seconds of physical USB access can flash arbitrary firmware, achieving persistent code execution that survives factory reset.

Root Cause

Discovery began with an anomalous device behavior: the MP4 player crashed and performed a full factory reset when loading a music file with an arbitrarily long filename. This served as an entry point into the firmware architecture.

A full 8.4 GB NAND flash dump was obtained via dd. Scanning the binary for firmware-relevant strings revealed a fully embedded Windows firmware update toolkit at offset 0x0265b11c inside the device's own flash partition — the attacker's tool was present on the device itself.

Inspection of Upgrade.ini revealed the CONFIG section contains no signature field, no checksum, no hash algorithm, and no authentication mechanism of any kind:

[CONFIG]
; No SignatureAlgorithm
; No Checksum
; No HashAlgorithm
; No AuthRequired
ProductName=MediaPlayer
FirmwareVersion=4.46
UpgradeTool=RdiskUpgrade.exe

Production.dll and RdiskUpgrade.exe accept any firmware image presented over USB without verification. Arbitrary firmware is written directly to NAND flash.

Affected Devices

This vulnerability affects all devices built on the Actions Semiconductor platform sharing USB Vendor ID 10D6. At least 12 USB Product IDs are affected, spanning multiple consumer brands and device models. Any MP3/MP4 player, voice recorder, or portable media device using the Actions Semiconductor chipset with this firmware update toolchain is vulnerable.

Attack Scenario

An attacker with brief physical access to the device proceeds as follows:

1. Connect device via USB (VID 10D6 enumerated)
2. Launch RdiskUpgrade.exe with a crafted Upgrade.ini
3. Flash arbitrary firmware image — no signature check, no prompt
4. Disconnect — compromise is permanent, survives factory reset
   Total time required: ~60 seconds

Plausible attack scenarios include supply chain tampering, shared charging stations, border inspection scenarios, and physical access by a malicious insider.

Impact

Full control over device firmware. A compromised device can be reprogrammed to act as a USB HID (keyboard/mouse) attack platform, an audio recording implant, or a persistent BadUSB device. The compromise is invisible to the user, survives factory reset, and leaves no log trail on the host system.

Discovery Method

Discovered through firmware analysis at ByteScan Security Research Lab. Initial entry point was a crash triggered by a long filename, leading to full NAND flash extraction and static analysis of the embedded update toolchain. Further information on ByteScan's research methodology is available at bytescan.net/vulcan.html.

Disclosure Timeline

• 2026-02-25 CVE request submitted to MITRE (service request 1998127).
• 2026-06-15 CVE-2026-36433 assigned by MITRE CVE Assignment Team.
• 2026-09-05 Public advisory published.

References

NVD entry: nvd.nist.gov/vuln/detail/CVE-2026-36433
CVE record: cve.org/CVERecord?id=CVE-2026-36433

Credits

Discovered and reported by Dr. Mohammadreza Ashouri, ByteScan Security Research Lab — audit@bytescan.net — bytescan.net — linkedin.com/in/drashouri