The Egret GT E-Scooter's Firmware Updates Need No Authentication

A developer who publishes under the name Ben spent enough time with an Egret GT electric scooter to identify all six of its principal chips, dump and disassemble their firmware, and rewrite that firmware from scratch in Rust. The write-up, dated Aug. 9, 2026, is a full bill of materials for a consumer vehicle nobody at Egret published: an AT32F415 running the main display, a CH573 handling Bluetooth, an FM17520 NFC reader, a motor-controller MCU labeled APM32E103xCxE that is a clone of ST's STM32F103, an ST7796 display driver and a W25Q128FV SPI flash chip holding it all together.

Component	Chip
Main / display MCU	AT32F415
Bluetooth MCU	CH573
NFC reader	FM17520
Motor controller MCU	APM32E103xCxE (STM32F103 clone)
Display controller	ST7796
SPI flash	W25Q128FV

What the firmware update process actually checks

Ben's most consequential finding is not a chip name but an absence. The scooter's internal CAN bus, the wiring protocol its controllers use to talk to each other, turns out to be reachable from outside the vehicle through the data pins of its USB-C port, a connector otherwise meant only for charging. Once on that bus, Ben found the firmware update process for all three of the scooter's update-able components, the display, the input panel and the main controller, accepts a new image over CAN with no cryptographic signature and no authentication step. The dashboard's update mode is supposed to require holding a button to enter a PIN-gated menu; Ben's write-up and Hackaday's Sept. 13, 2026 coverage both note it can be triggered by an ordinary, unintended sequence of dashboard presses, with no PIN actually enforced once triggered.

Separately, Ben's analysis of the companion mobile app found it transmitting telemetry tagged with a unique device identifier back to the manufacturer, data not surfaced anywhere on the scooter's own screen. That is a privacy footnote to the firmware story rather than the center of it, but it fits the same pattern: a device built with more channels than its owner can see or control.

Rewriting it, not just reading it

Getting to that finding took the standard reverse-engineering kit: Ghidra to disassemble the dumped firmware, an OpenOCD-driven debug probe and a Glasgow interface adapter to talk to the chips directly, and an oscilloscope to characterize signals Ben could not yet decode. The rewrite itself, once the protocols were understood, is real firmware: Rust using the Embassy async runtime, the mipidsi display driver crate and deku for binary protocol parsing, running on a custom hardware-abstraction layer Ben wrote for the AT32F4xx family by adapting an existing STM32 HAL. One firmware build string captured in the write-up, AT_R2_JHZY_GT1_GE_FM_HW02_4.0.2, is the kind of internal version tag Egret never intended a customer to read, let alone replace.

The distinction between reading a chip's firmware and replacing it with your own matters, because a dump-and-disassemble project proves a protocol is crackable; a working custom firmware image proves the vehicle will run code its manufacturer never signed, without complaint, indefinitely. That is the practical meaning of no cryptographic signature check: not a remote attacker halfway across a city, since CAN access here requires physically plugging into the scooter's own port, but an owner, a repair shop or a fleet operator with the same access having complete authority over what the hardware they already possess actually runs.

This is not a one-scooter problem

The absence of any cryptographic check on the Egret GT is unusual in degree but not in kind. SecurityWeek reported on April 28, 2026 that Zero Motorcycles firmware through version 44 let an attacker force a Bluetooth pairing and then push firmware over that connection, a flaw tracked as CVE-2026-1354. Dinesh Shetty, director of security engineering at Bureau Veritas Cybersecurity, told the outlet the pairing mode activates after holding a single button for about five seconds, after which "an attacker standing within Bluetooth range could jump in and pair their device to the bike." The same article covered a separate flaw in the Yadea T5 scooter's key fob, CVE-2025-70994, reported by independent researcher Ashen Chathuranga, that lets an attacker intercept and replay unlock commands.

What differs between those cases and the Egret GT is the channel and the intent behind the finding. Zero's and Yadea's flaws are remote-capable over Bluetooth and were reported through a disclosure process aimed at getting them patched. Ben's finding requires a wired connection to the vehicle's own port and was published as a repair and modification resource, not a disclosure. But the underlying fact, that a personal electric vehicle shipped with a control channel neither signed nor authenticated, now has three independent, differently sourced examples inside the space of five months.

What would change this read is Egret responding with a firmware update that adds a signature check, which would tell every other micromobility vendor building the same category of vehicle that the absence of one is a defect rather than an accepted cost of a fast product cycle. Nothing in Ben's write-up or Hackaday's coverage indicates Egret has done that, or said anything at all.

On the same reverse-engineering beat, see the reference guide one researcher wrote after reverse-engineering an undocumented Intel floating-point instruction from 1980, and on the vulnerability-disclosure side of hardware with weak authentication, how a satellite terminal vendor's own firmware shipped exploitable flaws.