{"id":"CVE-2022-21894","published":"2022-01-11T20:22:58Z","modified":"2025-01-02T18:23:05Z","title":"Secure Boot Security Feature Bypass Vulnerability","vendor":"Microsoft","product":"Windows 10 Version 1809","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft","product":"Windows 10 Version 1809","versions":[">= 10.0.17763.0, < 10.0.17763.2452"]},{"vendor":"Microsoft","product":"Windows 10 Version 1809","versions":[">= 10.0.0, < 10.0.17763.2452"]},{"vendor":"Microsoft","product":"Windows Server 2019","versions":[">= 10.0.17763.0, < 10.0.17763.2452"]},{"vendor":"Microsoft","product":"Windows Server 2019 (Server Core installation)","versions":[">= 10.0.17763.0, < 10.0.17763.2452"]},{"vendor":"Microsoft","product":"Windows 10 Version 1909","versions":[">= 10.0.0, < 10.0.18363.2037"]},{"vendor":"Microsoft","product":"Windows 10 Version 21H1","versions":[">= 10.0.0, < 10.0.19043.1466"]},{"vendor":"Microsoft","product":"Windows Server 2022","versions":[">= 10.0.20348.0, < 10.0.20348.469"]},{"vendor":"Microsoft","product":"Windows 10 Version 20H2","versions":[">= 10.0.0, < 10.0.19042.1466"]},{"vendor":"Microsoft","product":"Windows Server version 20H2","versions":[">= 10.0.0, < 10.0.19042.1466"]},{"vendor":"Microsoft","product":"Windows 11 version 21H2","versions":[">= 10.0.0, < 10.0.22000.434"]}],"description":{"text":"Secure Boot Security Feature Bypass Vulnerability","provenance":"source","from":"CVE.org"},"summary":{"text":"Microsoft Windows 10 Version 1809 contains a Secure Boot security feature bypass vulnerability, caused by incorrect authorization in the Secure Boot component. An attacker with local access and high privileges, requiring no user interaction, can bypass Secure Boot protections to affect system integrity.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T22:22:05Z"},"cvss":{"score":4.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.08632,"percentile":0.95103,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-03-01","exploitedFirstSeen":"2023-03-01","ransomware":false,"evidence":[{"url":"https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/","date":"2023-03-01"},{"url":"https://www.binarly.io/blog/the-untold-story-of-the-blacklotus-uefi-bootkit","date":"2023-03-03"},{"url":"https://cisa.gov/news-events/alerts/2023/04/11/microsoft-releases-guidance-for-the-blacklotus-campaign","date":"2023-04-11"},{"url":"https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign","date":"2023-04-11"},{"url":"https://msrc.microsoft.com/blog/2023/05/guidance-related-to-secure-boot-manager-changes-associated-with-cve-2023-24932/","date":"2023-05-09"},{"url":"https://media.defense.gov/2023/Jun/22/2003245723/-1/-1/0/CSI_BlackLotus_Mitigation_Guide.PDF","date":"2023-06-22"},{"url":"https://www.binarly.io/blog/from-trust-to-trouble-the-supply-chain-implications-of-a-broken-dbx","date":"2025-01-21"},{"url":"https://eclypsium.com/blog/the-top-5-firmware-and-hardware-attack-vectors/","date":"2025-04-16"},{"url":"https://eclypsium.com/blog/threat-detection-bootloaders-bootkits-secureboot/","date":"2025-05-22"},{"url":"https://mp.weixin.qq.com/s?__biz=MzAxODM5ODQzNQ==&mid=2247489797&idx=1&sn=ba62e2c2c8d9f2ebd3a9e3ee3d86f13f&poc_token=HC7Pk2ijKE8QjmJtRs55eWoLhHT2n-05r-liuxF3","date":"2025-08-05"}],"evidenceTotal":12,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21894","tags":["vendor-advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21894","tags":["x_refsource_MISC","x_transferred"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-27050","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-27050","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":0,"earliest":"2022-08-09","earliestUrl":"https://github.com/Wack0/CVE-2022-21894","repos":[{"name":"Wack0/CVE-2022-21894","url":"https://github.com/Wack0/CVE-2022-21894","stars":353,"created":"2022-08-09"},{"name":"ASkyeye/CVE-2022-21894-Payload","url":"https://github.com/ASkyeye/CVE-2022-21894-Payload","stars":15,"created":"2022-08-18"},{"name":"Wack0/batondrop_armv7","url":"https://github.com/Wack0/batondrop_armv7","stars":10,"created":"2023-03-11"},{"name":"nova-master/CVE-2022-21894-Payload-New","url":"https://github.com/nova-master/CVE-2022-21894-Payload-New","stars":4,"created":"2023-09-26"},{"name":"bakedmuffinman/BlackLotusDetection","url":"https://github.com/bakedmuffinman/BlackLotusDetection","stars":0,"created":"2023-04-12"}]},"first":{"date":"2022-08-09","source":"PoC-in-GitHub","url":"https://github.com/Wack0/CVE-2022-21894"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-01-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-21894","provenance":"source"},{"date":"2022-08-09","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Wack0/CVE-2022-21894","provenance":"source"},{"date":"2023-03-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/","provenance":"source"}],"speed":{"daysToPublicExploit":210,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":62.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1341 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.02,"detail":"percentile 0.9510"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"6 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.08,"detail":"base score 4.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-863"}}