CVE-2026-36933: Arbitrary Code Execution in Boyleep K11 y108 Factory Test Feature

Technical summary

CVE-2026-36933 is an improper access control vulnerability (CWE-284) in the Boyleep K11 y108 firmware 2.3.0.11291 that exposes a factory test interface without adequate authentication or authorization mechanisms. An attacker with physical proximity can invoke this test feature to execute arbitrary code at the device level. The attack vector is physical (AV:P), requires no privileges (PR:N), is straightforward to execute (AC:L), and does not require user interaction (UI:N). Impact spans confidentiality, integrity, and availability of the device.

Business impact

Organizations deploying Boyleep K11 y108 devices must assess whether these devices operate in physically secure environments. In settings where devices may be accessed by untrusted individuals—such as public kiosks, retail locations, or field-deployed hardware—this vulnerability enables complete device compromise. Attackers could exfiltrate sensitive data stored on the device, modify its behavior, disable it, or use it as an entry point into a broader network. The risk is directly proportional to the threat model of your deployment environment.

Affected systems

This vulnerability specifically affects Boyleep K11 y108 devices with firmware version 2.3.0.11291. Organizations should inventory all instances of this device model and firmware version in their environment. Check device management systems, procurement records, and active deployments. Firmware version details should be verified through the device web interface, CLI, or management platform used in your environment.

Exploitability

Exploitation requires physical access to the device, which significantly reduces the practical attack surface compared to remote vulnerabilities. However, CVSS score of 6.8 (MEDIUM) reflects the high impact once access is achieved. The attack is not complex and requires no special knowledge beyond accessing the factory test feature. This vulnerability does not currently appear on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no active widespread exploitation has been publicly documented. Nevertheless, physical access exploits are inherently difficult to detect and may be executed without leaving traces.

Remediation

Firmware updates should be prioritized for all Boyleep K11 y108 devices. Verify the current firmware version on affected devices and consult the Boyleep vendor advisory for patched firmware versions. Until patches can be applied, implement compensating controls: restrict physical access to devices through enclosures, locked cabinets, or controlled-access facilities; monitor device logs for unexpected administrative access; and consider isolating affected devices from sensitive networks if they store or process critical data.

Patch guidance

Check the Boyleep vendor advisory for patched firmware versions beyond 2.3.0.11291. Firmware updates should be staged in a test environment first to validate compatibility with your deployment. Plan updates during maintenance windows to minimize service disruption. Document the current firmware version before and after patching. If devices are managed centrally, prioritize bulk firmware deployment capabilities to update multiple units efficiently.

Detection guidance

Monitor for unauthorized access to factory test interfaces through device audit logs, if available. Look for unexpected administrative logins or configuration changes on affected devices. Inspect network traffic for unusual communication patterns from K11 y108 devices. Physical security monitoring—such as reviewing access logs to areas where these devices are located—may help identify unauthorized tampering. Correlate device logs with facility access records for suspicious activity.

Why prioritize this

While the CVSS score is MEDIUM (6.8), prioritization depends on your specific deployment context. If K11 y108 devices operate in physically controlled environments (data centers, locked facilities), the risk is lower and can be scheduled into normal patch cycles. If devices are deployed in public or semi-public spaces, remediation should be elevated to higher priority. The absence of KEV status suggests this is not an actively exploited vulnerability in the wild, but physical access exploits are inherently harder to detect, so assume-breach practices should apply.

Risk score, explained

The CVSS 3.1 score of 6.8 reflects a MEDIUM severity rating. Physical attack vector (AV:P) limits the threat to attackers with proximity, which reduces the base threat level compared to network-accessible exploits. However, the impact is complete: high confidentiality loss (C:H), high integrity loss (I:H), and high availability loss (A:H) once physical access is obtained. Low attack complexity (AC:L) and no privilege requirement (PR:N) mean exploitation is trivial once the attacker is physically present. The score appropriately balances limited access surface with severe consequences.

Frequently asked questions