CVE-2025-4275
HIGHInsydeH2O Kernel 5.2-5.7 - Secure Boot Bypass via NVRAM Variable Signature Verification Flaw
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-4275. PoCs published by NikolajSchlej, TheMalwareGuardian.
AI-analyzed exploit summary This PoC exploits a vulnerability in UEFI firmware by manipulating the SecureFlashVariable to achieve arbitrary code execution in the firmware context. The exploit leverages a crafted variable buffer to trigger a secure flash operation, potentially leading to privilege escalation or persistent code execution.
Description
A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verification by creating a non-authenticated NVRAM variable. An attacker may to execute arbitrary signed UEFI code and bypass Secure Boot.
Exploits (2)
This PoC exploits a vulnerability in UEFI firmware by manipulating the SecureFlashVariable to achieve arbitrary code execution in the firmware context. The exploit leverages a crafted variable buffer to trigger a secure flash operation, potentially leading to privilege escalation or persistent code execution.
This repository provides a functional proof-of-concept for CVE-2025-4275, a UEFI Secure Boot bypass vulnerability in Insyde H2O firmware. The exploit leverages improper validation of NVRAM variable volatility, allowing attackers to inject malicious certificates via non-volatile variables that persist across reboots and are trusted by SecurityStubDxe.
References (2)
Scores
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H