Mickey Shkatov

**Name of the Vulnerable Software and Affected Versions** Microsoft-signed third-party bootloader (affected versions not specified) **Description** A security-feature bypass allows attackers to affect the system. A Microsoft-signed third-party bootloader completely skips signature verification when loading drivers, which enables a Secure Boot bypass on most Windows systems. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell BIOS (affected versions not specified) **Description** The issue allows an unauthenticated local attacker with physical access to the system and knowledge of the system configuration to potentially exploit it and read system information via debug interfaces. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eurosoft bootloaders versions prior to 2022-06-01 **Description** A flaw was found in Eurosoft bootloaders that allows an attacker to bypass or tamper with Secure Boot protections. To load and execute arbitrary code in the pre-boot stage, an attacker needs to replace the existing signed bootloader with this bootloader, requiring access to the EFI System Partition for booting using external media. Additionally, there is a security-feature bypass vulnerability that allows attackers to affect the system. A related issue concerns errors in security settings of the Crypto Pro bootloader in Windows, which can be exploited to bypass security restrictions and gain unauthorized access to the system. **Recommendations** For Eurosoft bootloaders versions prior to 2022-06-01, consider restricting access to the EFI System Partition to minimize the risk of exploitation. As a temporary workaround, avoid using external media for booting until a patch is available. Restrict access to the Crypto Pro bootloader in Windows to prevent potential bypass of security restrictions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CryptoPro Secure Disk versions before 2022-06-01 **Description** A flaw was found in the bootloaders, allowing an attacker to bypass or tamper with Secure Boot protections. To load and execute arbitrary code in the pre-boot stage, an attacker needs to replace the existing signed bootloader with this one, requiring access to the EFI System Partition for booting using external media. The vulnerability is related to errors in security settings, which can be exploited to bypass existing security restrictions. **Recommendations** For versions before 2022-06-01, consider restricting access to the EFI System Partition to minimize the risk of exploitation. As a temporary workaround, avoid using external media for booting until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** New Horizon Datasys bootloaders before 2022-06-01 **Description** A flaw was found in the bootloaders, allowing an attacker to bypass or tamper with Secure Boot protections. To load and execute arbitrary code in the pre-boot stage, an attacker needs to replace the existing signed bootloader with this one, requiring access to the EFI System Partition for booting using external media. The vulnerability is related to errors in security settings, which can be exploited to bypass existing security restrictions. **Recommendations** For versions before 2022-06-01, consider restricting access to the EFI System Partition to minimize the risk of exploitation. As a temporary workaround, avoid using external media for booting until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel(R) Boot Guard and Intel(R) TXT (affected versions not specified) **Description** The issue is related to the implementation of Intel(R) Boot Guard and Intel(R) TXT technologies in Intel(R) processors, which may allow an unauthenticated user to potentially enable escalation of privilege via physical access. This is due to incorrect handling of parameters in the hardware debug modes and processor INIT setting, allowing override of locks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to errors in the Windows Certificate authentication procedure, allowing an attacker to conduct spoofing attacks. It is associated with data substitution, enabling malicious actors to impact the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell BIOSConnect (affected versions not specified) **Description** The Dell BIOSConnect feature contains a buffer overflow issue. An authenticated malicious admin user with local access to the system may potentially exploit this to run arbitrary code and bypass UEFI restrictions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell BIOSConnect (affected versions not specified) **Description** The Dell BIOSConnect feature contains a buffer overflow issue. An authenticated malicious admin user with local access to the system may potentially exploit this to run arbitrary code and bypass UEFI restrictions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell BIOSConnect (affected versions not specified) **Description** The Dell BIOSConnect feature contains a buffer overflow issue. An authenticated malicious admin user with local access to the system may potentially exploit this to run arbitrary code and bypass UEFI restrictions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GRUB2 versions prior to 2.06 **Description** A flaw was found in GRUB2 that allows an attacker to hijack and tamper with the GRUB verification process, bypassing Secure Boot protections. This can be exploited to load an untrusted or modified kernel, potentially leading to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. An attacker would first need to establish access to the system, such as gaining physical access or obtaining remote access to a networked system with root access. With this access, an attacker could craft a string to cause a buffer overflow by injecting a malicious payload. **Recommendations** To resolve the issue for GRUB2 versions prior to 2.06, update to version 2.06 or later. As a temporary workaround, consider restricting access to the GRUB configuration file to minimize the risk of exploitation. Additionally, ensure that Secure Boot is enabled and properly configured to reduce the risk of malicious code execution.

**Name of the Vulnerable Software and Affected Versions** atillk64.sys version 5.11.9.0 **Description** The issue allows low-privileged users to interact directly with physical memory by calling one of several driver routines that map physical memory into the virtual address space of the calling process. This could enable low-privileged users to achieve NT AUTHORITYSYSTEM privileges via a DeviceIoControl call associated with `MmMapIoSpace`, `IoAllocateMdl`, `MmBuildMdlForNonPagedPool`, or `MmMapLockedPages`. **Recommendations** For atillk64.sys version 5.11.9.0, consider restricting access to the driver routines `MmMapIoSpace`, `IoAllocateMdl`, `MmBuildMdlForNonPagedPool`, and `MmMapLockedPages` to prevent low-privileged users from achieving NT AUTHORITYSYSTEM privileges. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell XPS 13 2-in-1 (7390) BIOS versions prior to 1.1.3 **Description** The BIOS configuration for the "Enable Thunderbolt (and PCIe behind TBT) pre-boot modules" setting is enabled by default, allowing a local unauthenticated attacker with physical access to a user's system to obtain read or write access to main memory via a DMA attack during platform boot. **Recommendations** For Dell XPS 13 2-in-1 (7390) BIOS versions prior to 1.1.3, update the BIOS to version 1.1.3 or later to resolve the issue. As a temporary workaround, consider disabling the "Enable Thunderbolt (and PCIe behind TBT) pre-boot modules" setting in the BIOS configuration to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** H2OFFT versions 3.02 through 5.28 H2OFFT versions 100.00.00.00 through 100.00.08.23 H2OFFT versions 200.00.00.01 through 200.00.00.05 H2OOAE versions prior to 200.00.00.02 H2OSDE versions prior to 200.00.00.07 H2OUVE versions prior to 200.00.02.02 H2OPCM versions prior to 100.00.06.00 H2OELV versions prior to 100.00.02.08 **Description** The issue is related to improper access control in the Insyde software tools, which may allow an authenticated user to potentially enable escalation of privilege or information disclosure via local access. This is a software vulnerability and not a firmware issue. **Recommendations** For H2OFFT versions 3.02 through 5.28, update to a version outside of this range. For H2OFFT versions 100.00.00.00 through 100.00.08.23, update to a version outside of this range. For H2OFFT versions 200.00.00.01 through 200.00.00.05, update to a version outside of this range. For H2OOAE versions prior to 200.00.00.02, update to version 200.00.00.02 or later. For H2OSDE versions prior to 200.00.00.07, update to version 200.00.00.07 or later. For H2OUVE versions prior to 200.00.02.02, update to version 200.00.02.02 or later. For H2OPCM versions prior to 100.00.06.00, update to version 100.00.06.00 or later. For H2OELV versions prior to 100.00.02.08, update to version 100.00.02.08 or later.

**Name of the Vulnerable Software and Affected Versions** Huawei PCManager versions prior to 9.0.1.66 (Oversea) Huawei PCManager versions prior to 9.0.1.70 (China) **Description** The issue is related to an information leak. Successful exploitation may allow an attacker to read information. The vulnerability is associated with a lack of protection for service data, which could enable an attacker to disclose protected information. **Recommendations** For versions prior to 9.0.1.66 (Oversea), update to version 9.0.1.66 or later. For versions prior to 9.0.1.70 (China), update to version 9.0.1.70 or later.

**Name of the Vulnerable Software and Affected Versions** Huawei PCManager versions prior to 9.0.1.66 (Oversea) Huawei PCManager versions prior to 9.0.1.70 (China) **Description** The issue is related to insufficient access control in the Huawei PCManager application, allowing for code execution. Successful exploitation may enable an attacker to execute code and read/write information, potentially leading to arbitrary file writing. **Recommendations** For versions prior to 9.0.1.66 (Oversea), update to version 9.0.1.66 or later. For versions prior to 9.0.1.70 (China), update to version 9.0.1.70 or later.

**Name of the Vulnerable Software and Affected Versions** Huawei PC Manager versions prior to 9.0.1.66 (Oversea) Huawei PC Manager versions prior to 9.0.1.70 (China) **Description** The issue is related to insufficient access control in the Huawei PC Manager application, allowing an attacker to execute arbitrary code and write arbitrary files. Successful exploitation of this issue may cause the attacker to execute code and read or write information. **Recommendations** For versions prior to 9.0.1.66 (Oversea), update to version 9.0.1.66 or later. For versions prior to 9.0.1.70 (China), update to version 9.0.1.70 or later.

**Name of the Vulnerable Software and Affected Versions** Infineon S-Gold 2 (PMB 8876) chipset versions used in various vehicle models produced between 2009-2016 **Description** An issue with improper restriction of operations within the bounds of a memory buffer was found. This issue may allow an attacker to access and control memory, potentially enabling remote code execution on the baseband radio processor of the Telematics Control Unit (TCU). The vulnerability is related to the temporary mobile subscriber identity (TMSI). **Recommendations** For the Infineon S-Gold 2 (PMB 8876) chipset used in the affected vehicle models, consider restricting access to the vulnerable TMSI component until a patch or fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 9 **Description** The issue is related to how WebKit in iOS handles "Content-Disposition: attachment" HTTP headers, which could allow man-in-the-middle attackers to obtain sensitive information. Exploitation of this issue may enable a remote attacker to access protected information by conducting man-in-the-middle attacks. **Recommendations** For versions prior to 9, update to iOS version 9 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 5 **Description** A cross-site scripting (XSS) issue allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header. **Recommendations** For versions prior to 5, update to iOS version 5 or later to resolve the issue.