Critical Unsigned Firmware Update in Actions Semiconductor Platform

What We Found

During hands-on firmware analysis of a consumer music player by our team we found a critical vulnerability discovered in the firmware update mechanism of all devices built on the Actions Semiconductor platform. The update toolchain performs no any cryptographic validation before writing arbitrary firmware to the device!

That means for example an attacker with physical USB access can permanently compromise any affected device with fully custom firmware, with the compromise surviving factory reset.

How We Got Here

Initial Observation

Our investigation began with an anomalous device behaviour: the Lenco Xemio-860 crashed and performed a full factory reset when loading a music file with an arbitrary long filename. This indicated absent or broken input validation in the file system parser. Rather than treating the crash as a minor annoyance, it was used as an entry point to investigate the full firmware architecture.

Firmware Extraction

The device presents itself as a standard USB mass storage device. A raw disk dump was performed to capture the full 8.4 GB NAND flash image at the block device level:

sudo diskutil unmountDisk /dev/diskX
sudo dd if=/dev/diskX of=xemio860_raw.bin bs=4096 status=progress

Result: 8,376,025,088 bytes captured in approximately 14 minutes at 10 MB/s. The dump produced a complete binary image of the device flash, including all partitions.

Binary Triage

We wrote a specific script in order to scan the raw binary for ASCII strings matching firmware-relevant keywords: upgrade, update, firmware, system, version, commaxx, lenco. This scan showed a fully embedded Windows firmware update toolkit at flash offset 0x0265b11c, with all files confirming the SoC vendor as Actions Semiconductor.

Update Tool Discovery

The embedded toolkit was stored as a ZIP archive within the flash containing the complete Windows firmware flashing utility:

Configuration Analysis

The Upgrade.ini CONFIG section revealed the complete lack of any security configuration:

FWFILE=          ← blank — accepts ANY firmware binary
UISKIN=skin-upgrade
VER00=1.00.01

We noticed that there is no signature field, no checksum parameter, no even hash algorithm, not even an authentication mechanism of any kind. The FWFILE key is blank — the tool accepts any firmware binary the user points it at and flashes it without question. And that's the vulnerability.

Confirming Zero Cryptographic Verification

strings Production.dll | grep -i 'sign|verify|hash|md5|sha|rsa|aes|encrypt'

Zero firmware-related cryptographic functions found in a 2.57 MB binary. The flashing logic performs no verification whatsoever before writing to the device.

USB Device Identification

The driver INF file identified the full scope of vulnerable devices. Actions Semiconductor USB Vendor ID 10D6 covers 12 distinct Product IDs, meaning this vulnerability extends across a wide range of budget consumer devices from multiple brands:

Attack Capability & Scenarios

Because Production.dll accepts and flashes any firmware binary with no validation, a malicious user with brief physical USB access can achieve all of the following:

• → Flash arbitrary firmware, replacing the complete device operating system
• → Gain persistent code execution that survives factory reset and power cycling
• → Modify device behaviour invisibly with zero external indicators of compromise
• → Silently extract any data stored on the device or inserted SD card
• → Repurpose device hardware (microphone, storage, Bluetooth) for malicious purposes

Reproducible Evidence

The following test cases were executed against the Lenco Xemio-860BK running firmware VER00=1.00.01. Each test is independently reproducible on any device sharing Actions Semiconductor VID 10D6.

Tools Used in This Research

What This Research Teaches

• 01 Consumer devices often embed their own attack tools — the firmware flasher was stored on the device itself inside the user-accessible flash partition.
• 02 Configuration files are the fastest proof of absent security controls. A missing signature field in Upgrade.ini took seconds to read and was immediately conclusive.
• 03 Strings analysis of production DLLs delivers fast, definitive proof. Zero cryptographic function names in a 2.57 MB binary confirms the absence of any validation logic.
• 04 USB Vendor IDs dramatically expand CVE scope. One finding covering VID 10D6 potentially affects dozens of products across multiple consumer electronics brands worldwide.
• 05 Physical access vulnerabilities are publishable, MITRE-assignable CVEs. They are not second-class findings in the security community.
• 06 The initial crash (filename overflow) was a launchpad, not the destination. Following anomalous behaviour deeper into the firmware architecture revealed a far more impactful finding.

Disclosure Timeline

Full CVE details: bytescan.net/CVE