Stas Lyakhov

A flaw in the Unified Extensible Firmware Interface (UEFI) Shell implementation allows an authenticated attacker with user or admin credentials, or an unauthenticated attacker with physical access, to bypass UEFI Secure Boot validation checks. This occurs because memory write commands remain available in the UEFI Shell even when UEFI Secure Boot is enabled. An attacker can select the UEFI Shell boot option during startup and use shell commands to modify UEFI memory variables, enabling them to manipulate the preboot environment, overwrite Secure Boot-related memory values, and execute unauthorized software.

A security-feature bypass allows attackers to affect the system. A Microsoft-signed third-party bootloader completely skips signature verification when loading drivers, which enables a Secure Boot bypass on most Windows systems.