So, the good news is that I can probably now get root on almost any Linux-based device I own. Don't even need to solder on a serial port or w/e, just direct network connection.
Yeah this is really a blessing for people seeking more control over nice hardware with horrible software, "smart" spy TVs, Android (moar ads on your) TV boxes, cheap insecure security camera's with only Crappy Cloud subscriptions... Go AI!
Dual or quad core is not that unusual even in very cheap SoCs, but this particular CVE needs a kernel line from this decade. Thousands of other CVEs indeed..
Was going to say that, depending on the device's age, this law may apply, where article 13 sub 9 specifies a decade of updates is the minimum: https://eur-lex.europa.eu/eli/reg/2024/2847/oj
But then it turns out that this "applies from" late 2027 :/
Simultaneously Wikipedia says the Act has "entered into force" in 2024. Does anyone know the difference between "enters into force" and "applies"? Is it like this 2016–2018 grace period for GDPR where it was "law" but not enforced? (The wording sounds backwards if it's that, but I'm not a native speaker)
That's how i'd read it but i'm not 100% sure. legal terms can have specific meanings in a legal context that's different from general use.
but also this is one of those cases where, ok you have a law, but, that's meaningless. It's not enforceable. It's not even monitorable. It's nice in theory to write down a bunch of regulations but at best you can make a bunch of EU companies do some paperwork. anything imported from outside the EU, the company can agree to everything and then dissapear. ALl the direct to consumer slop on amazon and whatever. How is the EU supposed to enforce a law against a random fly by night brand name in Shenzhen?
> As volumes rise, enforcement is weakening. In 2025, the EU control rate fell to 65 items per million items imported. The rate of goods ultimately refused at the border due to non-compliance or because they posed serious risks, also fell to below 10 items per million.
> A large-scale customs investigation launched by the Commission in 2025 highlights the scale of the problem. Over 60% of checked toys, small electronics, cosmetics, personal protective equipment and food supplements bought online from outside the EU failed to meet EU product compliance and safety requirements.
So, the good news is that I can probably now get root on almost any Linux-based device I own. Don't even need to solder on a serial port or w/e, just direct network connection.
Yeah this is really a blessing for people seeking more control over nice hardware with horrible software, "smart" spy TVs, Android (moar ads on your) TV boxes, cheap insecure security camera's with only Crappy Cloud subscriptions... Go AI!
Needs two cpus at least, so a lot IoTs are spared because of that
But are they exploitably vulnerable to this specifically in typical setups?
To be fair probably not as many will be single core and this requires multi-core. As for the thousands of other CVEs though ...
Dual or quad core is not that unusual even in very cheap SoCs, but this particular CVE needs a kernel line from this decade. Thousands of other CVEs indeed..
The security fixed will be installed next tuesday.
Was going to say that, depending on the device's age, this law may apply, where article 13 sub 9 specifies a decade of updates is the minimum: https://eur-lex.europa.eu/eli/reg/2024/2847/oj But then it turns out that this "applies from" late 2027 :/
Simultaneously Wikipedia says the Act has "entered into force" in 2024. Does anyone know the difference between "enters into force" and "applies"? Is it like this 2016–2018 grace period for GDPR where it was "law" but not enforced? (The wording sounds backwards if it's that, but I'm not a native speaker)
That's how i'd read it but i'm not 100% sure. legal terms can have specific meanings in a legal context that's different from general use.
but also this is one of those cases where, ok you have a law, but, that's meaningless. It's not enforceable. It's not even monitorable. It's nice in theory to write down a bunch of regulations but at best you can make a bunch of EU companies do some paperwork. anything imported from outside the EU, the company can agree to everything and then dissapear. ALl the direct to consumer slop on amazon and whatever. How is the EU supposed to enforce a law against a random fly by night brand name in Shenzhen?
From https://taxation-customs.ec.europa.eu/news/report-highlights...
> As volumes rise, enforcement is weakening. In 2025, the EU control rate fell to 65 items per million items imported. The rate of goods ultimately refused at the border due to non-compliance or because they posed serious risks, also fell to below 10 items per million.
> A large-scale customs investigation launched by the Commission in 2025 highlights the scale of the problem. Over 60% of checked toys, small electronics, cosmetics, personal protective equipment and food supplements bought online from outside the EU failed to meet EU product compliance and safety requirements.
It's just regulation theater. It's meaningless.