A strategy game released in June 2025 that had already fallen out of discussion has suddenly become the hottest game in the Nintendo Switch 2 hacking scene. The reason is that the multiplayer chat room feature in the original Switch physical cartridge of Sid Meier’s Civilization VII contains an unpatched vulnerability. Switch 2 hackers have been buying up these cartridges in large quantities over the past few days, using them as an entry point for hacking the console. The situation has become serious enough that publisher 2K is reportedly beginning to recall physical editions, and new orders are also being canceled at retailers one after another.
A chatroom vulnerability has been discovered in the Civilization VII cartridge, becoming a hacking entry point for Switch 2.
The entry point opened by the 87-line chatroom code: CivSwitch
The core of this wave of cracking is the toolchain released by hacker and modder Gezine: “CivSwitch”, it was listed on GitHub on November 1. The vulnerability itself is a cross-site scripting (XSS) issue in the multiplayer chat room of the Nintendo Switch version of Civilization 7: the game uses a browser-like component to render chat text, and entered content is executed as code; a detailed demonstration of the process is already available on reddit.
CivSwitch hack start to finish
byu/Melon__Bread inswitch2hacks
In practice, players need a physical 1.0.0 cartridge that has not been updated, then plug a flashed Raspberry Pi Pico or Pico 2 into the console. The Pico emulates a USB keyboard and automatically types about 87 lines of exploit code into the game’s wireless lobby chat window; the whole process takes 15 to 20 minutes. After the code is sent, a remote JavaScript loader listening on TCP port 9026 starts on the console, after which arbitrary payloads can be pushed from a PC. The toolchain’s default payload is the “Remote JS Loader” launcher, and the chat text transmission also includes compression and profanity-filter evasion handling. The toolchain also includes an installer that writes the trigger into the save file, so the vulnerability can be run again every time the game is loaded at boot.
The scope covers both Switch and Switch 2 generations, and firmware 20.0.0 through 23.0.1 all work. The reason for such a broad range is that the vulnerability lies on the game side, not the system side; Switch 2 runs the same cartridge via backward compatibility and follows the same program path. Any device that can emulate a keyboard can replace the Pico; Switch 1 or a Raspberry Pi with the piDucky project are both viable, and some players already plan to port it to ESP32-S3.
It can run homebrew, but it still can’t run pirated games.
Fortunately, at present this vulnerability cannot be used to run pirated Switch 2 games; what it can do is access game saves, enable game modding, and run homebrew programs. Technically, this is a userland entry point, meaning the code runs inside the game application’s sandbox, without escaping the sandbox’s restrictions or rewriting the system firmware, so it is actually of little use to ordinary players. There is also a practical risk for ordinary players: CivSwitch’s installer deletes single-player campaign progress in the save directory, wiping out a half-finished Civilization playthrough. However, in the AI era, progress in console modding and cracking has now accelerated significantly because of AI-assisted coding tools (such as the PS5, which has recently been cracked very thoroughly), and it is hard to predict what will be possible in a few weeks.
At present, this vulnerability exists only in the physical game card version. The physical card freezes the 1.0.0 launch version of the game on the chip, so as long as players do not manually update it, they can remain on the vulnerable version forever; the digital store only supplies the latest version, so it cannot access this entry point. After the vulnerability was exposed, physical Switch cartridges of Civilization VII were bid up to high prices in the secondhand market, and Switch 2 hacking forums were flooded with purchasing tips and operation tutorials.
Rumors have now emerged that the game company is recalling the game. Reddit user MaruluVR posted a letter from a German Amazon distributor stating that “the publisher has withdrawn the physical game cartridge version” due to “technical and security-related requirements”; orders can only be canceled and refunded, or switched to a boxed version with a download code. In the past, whenever a game was revealed to be usable as an entry point for hacking, the entire market would be swept up in panic buying and scalping, and prices would skyrocket.
Cvilization VII Cartridge is being recalled by publisher
byu/MaruluVR inswitch2hacks
In fact, using physical games as exploit vectors has a long history in Nintendo hardware. In the Wii era, the community used a vulnerability in save-file parsing in Twilight Princess to run homebrew, known as the Twilight Hack; CivSwitch is a modern version of the same logic, with user-controlled data shifting from save files to chat text and the loading device shifting from a memory card to a microcontroller. What is new is that this time the door has been opened on a third-party game. Previously, well-known Nintendo vulnerabilities mostly lay in first-party games or system firmware; this time, a third-party strategy game from 2K bears the security responsibility. In theory, any cross-platform title that embeds web-based chat, menu components, or an in-game browser could be studied using the same technique.
Source:kotaku
Source: KOCPC Chinese