CVE-2025-11577 — Clevo UEFI firmware exposed Boot Guard private keys, enabling potential abuse of the Boot Guard trust chain

CVE-2025-11577

Clevo UEFI firmware exposed Boot Guard private keys, enabling potential abuse of the Boot Guard trust chain PUBLISHED

Description (CNA)

Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Policy Manifest verification. The exposure of these keys could allow attackers to sign malicious firmware that appears trusted by affected systems, undermining the integrity of the early boot process.

Affected (CNA)

Vendor / product	Versions
Clevo / Notebook System Firmware	affected 1.07.07TRO1

CWE

No CWE identifiers supplied.

References

https://www.binarly.io/advisories/brly-2025-002
https://www.kb.cert.org/vuls/id/538470

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.