CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
34.5%
A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.
Vendor | Product | Version | CPE |
---|---|---|---|
horizondatasys | uefi_bootloader | * | cpe:2.3:o:horizondatasys:uefi_bootloader:*:*:*:*:*:*:*:* |
redhat | enterprise_linux | 7.0 | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
redhat | enterprise_linux | 8.0 | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
redhat | enterprise_linux | 9.0 | cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |
microsoft | windows_10 | - | cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* |
microsoft | windows_10 | 20h2 | cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:* |
microsoft | windows_10 | 21h1 | cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:*:* |
microsoft | windows_10 | 21h2 | cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:*:* |
microsoft | windows_10 | 1607 | cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* |
microsoft | windows_10 | 1809 | cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* |
More