Tool runs code on Switch 2 via unpatched cartridge flaw
The unpatched flaw is in original Switch cartridges: CivSwitch, a tool by modder Gezine, runs phone-fed code over USB on the Switch 2, opening it to saves, mods and homebrew; pirated Switch 2 games don't run for now. 2K, publisher of Civilization VII, has reportedly begun recalling physical copies, and one buyer says Amazon cancelled their order over a 2K mandate; 2K hasn't commented. The exploit doesn't work on the code-in-box edition offered to some buyers.
What happened
An unpatched flaw in original Switch cartridges lets the public tool CivSwitch run code on the Nintendo Switch 2 from a phone over USB. The method opens the console to saves, mods and homebrew apps. Pirated Switch 2 games don't run for now.
Why it matters
The case removes the manufacturer's control over the console ecosystem: modified saves and unauthorized software can run. 2K, publisher of Civilization VII, whose cartridge is used in the method, has reportedly started recalling physical copies, with one Amazon order cancellation reported. Pirated Switch 2 games don't run for now.
What to do
Wait for statements from Nintendo and 2K; the physical recall is only reported and 2K hasn't commented. Buyers should confirm which edition they receive, since the method doesn't work on the code-in-box edition.
For the technical team
- Affected
- Nintendo Switch 2 (cartuchos do Switch original) · Nintendo Switch 2, through original Switch cartridges; the Civilization VII cartridge is the one cited in the method. The code-in-box edition is not affected.
- Exploitation
- Public tool: CivSwitch, by modder Gezine, runs phone-fed code over USB; the source reports saves, mods and homebrew. Pirated Switch 2 games don't run for now.
- Fix
- No fix cited in the sources; the flaw is described as unpatched. The physical recall by 2K is only reported; 2K hasn't commented.
- Vector
- Original Switch cartridge (the Civilization VII cart is the one cited): unpatched flaw; CivSwitch feeds code from a phone over USB and executes on the Switch 2. Requires the physical cartridge; the code-in-box edition doesn't work.
- More details
- One buyer says Amazon cancelled their order over a 2K mandate and "technical and security-related requirements"; some buyers say they were offered the code-in-box edition, on which the exploit doesn't work.
Timeline
First batch: public tool exploits the flaw and 2K reportedly began recalling physical cartridges.
Sources 1 source
- @IntCyberDigest @IntCyberDigest
