← CVE Intelligence

CVE-2025-4275

SecureFlashDxe: Incorrect UEFI variable attributes check allows usage of invalid certificate PUBLISHED

Description (CNA)

A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verification by creating a non-authenticated NVRAM variable. An attacker may to execute arbitrary signed UEFI code and bypass Secure Boot.

Affected (CNA)

Vendor / productVersions
Insyde Software / InsydeH2Oaffected Kernel 5.2 before 05.2A.16; affected Kernel 5.3 before 05.39.16; affected Kernel 5.4 before 05.47.16; affected Kernel 5.5 before 05.55.16; affected Kernel 5.6 before 05.62.16; affected Kernel 5.7 before 05.71.16

CWE

No CWE identifiers supplied.

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.