Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2025-4275

SecureFlashDxe: Incorrect UEFI variable attributes check allows usage of invalid certificate

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Insyde

Description

A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verification by creating a non-authenticated NVRAM variable. An attacker may to execute arbitrary signed UEFI code and bypass Secure Boot.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Insyde Software InsydeH2O

Default version status: unknown

  • Kernel 5.2 to < 05.2A.16affected
  • Kernel 5.3 to < 05.39.16affected
  • Kernel 5.4 to < 05.47.16affected
  • Kernel 5.5 to < 05.55.16affected
  • Kernel 5.6 to < 05.62.16affected
  • Kernel 5.7 to < 05.71.16affected

References