EUVD-2025-18070CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3Description
A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verification by creating a non-authenticated NVRAM variable. An attacker may to execute arbitrary signed UEFI code and bypass Secure Boot.
Analysis
Critical Secure Boot bypass vulnerability in UEFI firmware affecting systems with improper digital signature verification in the NVRAM variable validation process. Attackers with local access and low privileges can create malicious non-authenticated NVRAM variables to bypass signature verification mechanisms, enabling execution of arbitrary signed UEFI code and circumventing Secure Boot protections. This vulnerability requires local access and non-trivial complexity but impacts core boot security; real-world exploitation likelihood and active KEV status are critical factors pending vendor disclosure.
Technical Context
The vulnerability exists in UEFI firmware's digital signature verification subsystem, specifically in the validation logic for NVRAM (Non-Volatile RAM) variable attributes. UEFI Secure Boot relies on cryptographic signature verification to ensure only authorized firmware and boot components execute. The root cause appears to be insufficient attribute validation during signature verification—attackers can manipulate or forge NVRAM variable attributes without proper authentication checks, bypassing the signature validation that should prevent unauthorized code execution. The CWE is not explicitly specified but likely relates to CWE-347 (Improper Verification of Cryptographic Signature) or CWE-345 (Insufficient Verification of Data Authenticity). This affects firmware implementations across multiple vendors that share similar UEFI Secure Boot implementations, particularly those using common firmware libraries or reference implementations. The attack leverages the persistent nature of NVRAM variables and their role in boot-time security decisions.
Affected Products
The description does not specify vendor or product names, but CVE-2025-4275 likely affects multiple UEFI firmware implementations from OEMs including (but not limited to) Intel, AMD, Dell, HP, Lenovo, and other manufacturers whose systems implement UEFI Secure Boot. Specific CPE data is not provided in the intelligence; however, affected systems typically include: - Enterprise and consumer x86/x64 systems with UEFI firmware - Systems with Intel or AMD processors relying on UEFI Secure Boot - OEM firmware versions that do not validate NVRAM variable attributes before signature verification Vendor advisories, specific version numbers, and CPE strings must be obtained from manufacturer security bulletins (Intel PSIRT, AMD Security, Dell Security Advisories, etc.). Affected versions likely range across multiple firmware releases depending on vendor patch timelines.
Remediation
Specific patch versions are not provided in the available intelligence. Remediation steps will include: 1. IMMEDIATE: Contact your OEM/firmware vendor (Intel, Dell, HP, Lenovo, etc.) for Secure Boot-related security updates and apply them immediately to affected systems. 2. Check vendor advisories: Monitor Intel PSIRT, AMD Security Notices, Dell Security Updates, and HP Security Bulletins for CVE-2025-4275 patches. 3. BIOS/UEFI firmware updates: Obtain and deploy the latest firmware versions that properly validate NVRAM variable attributes during signature verification. 4. Temporary mitigation (until patching): Restrict physical access to systems and disable NVRAM modification if administrative interfaces permit; however, this does not fully address the vulnerability. 5. Verify firmware integrity: Use OEM-provided firmware verification tools post-patch to ensure Secure Boot enforcement is restored. 6. Review boot logs: Check system logs for signs of unauthorized NVRAM variable modifications or boot anomalies. Vendor patches should be available within weeks to months of CVE publication; check official vendor security pages for timelines.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today