BitBox Releases Critical Firmware Update to Patch Two Severe Vulnerabilities

BitBox published a firmware update that fixes two vulnerabilities described as “severe” in its cold storage devices. The company recommended all users update to version 9.26.5 and confirmed it received no reports of exploits or loss of funds.

The first flaw involves a memory corruption issue in the Multi and Nova editions of BitBox02 that had not been configured with a wallet. A malicious host could have exploited it to execute arbitrary code and install malicious firmware, posing a direct risk to stored funds.

The second affected the implementation of Silent Payments and could have allowed an attacker to lock bitcoin in an unintended address. Although direct theft was not possible, the scenario opened the door to a potential ransom attack to recover the coins.

The patch comes at a critical moment for self-custody. A firmware flaw in Coldcard, linked to a change introduced in March 2021 and detected more than five years later, led to losses exceeding $112 million in bitcoin, according to Galaxy Research.

… Continue reading the full article at the original source below.