An arbitrary write vulnerability in Microsoft signed UEFI firmware from DT Research Inc. (DT Research BiosFlashShell)
En bref
- Source
- NVD
- EPSS
- EPSS 0.43 % · centile 37 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- certcc
- Statut NVD
- Deferred
Rechercher sur…
Description
An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker to control its value, leading to arbitrary memory writes, including modification of critical firmware settings stored in NVRAM. Exploiting this vulnerability could enable security bypasses, persistence mechanisms, or full system compromise.
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-17820
- GCVE · GCVE-0-2025-3052
Avis du CERT-FR
- CERTFR-2025-AVI-0499 — Multiples vulnérabilités dans Microsoft Windows · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| DT Research · BiosFlashShell | affected 80.02 |
| DT Research · BiosFlashShell | affected 81.02 |
| DT Research · Dtbios | affected 70.17 |
| DT Research · Dtbios | affected 70.18 |
| DT Research · Dtbios | affected 70.19 |
| DT Research · Dtbios | affected 70.20 |
| DT Research · Dtbios | affected 70.21 |
| DT Research · Dtbios | affected 70.22 |
| DT Research · Dtbios | affected 71.17 |
| DT Research · Dtbios | affected 71.18 |
| DT Research · Dtbios | affected 71.19 |
| DT Research · Dtbios | affected 71.20 |
| DT Research · Dtbios | affected 71.21 |
| DT Research · Dtbios | affected 71.22 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |