Zammis Clark

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a security-feature bypass vulnerability in the Secure Boot security component of the Windows operating system. This vulnerability is associated with a disruption in the data protection mechanism. Exploitation of this issue may allow an attacker to bypass security restrictions. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to errors in access control within the Secure Boot protocol implementation in the Windows operating system. This can allow an attacker to disclose protected information. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified) Description: The issue is related to a buffer overflow in dynamic memory in the implementation of the Secure Boot protocol in Windows operating systems. This can be exploited by sending specially crafted data, allowing an attacker to bypass existing security restrictions. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a buffer overflow in memory during the implementation of the Secure Boot protocol in Windows operating systems. This could allow an attacker to bypass security restrictions. A security-feature bypass vulnerability allows attackers to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a security feature bypass vulnerability in the implementation of the Secure Boot protocol in Windows operating systems. This vulnerability is associated with inadequate access control restrictions. Exploitation of this issue may allow an attacker to bypass security restrictions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a security feature bypass in the implementation of the Secure Boot protocol in Windows operating systems, which is associated with a data protection mechanism violation. This could allow an attacker to bypass security restrictions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a security-feature bypass vulnerability in the implementation of the Secure Boot protocol in Windows operating systems. This vulnerability is associated with a data protection mechanism breach. Exploitation of this issue may allow an attacker to bypass existing security restrictions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a security-feature bypass vulnerability in the implementation of the Secure Boot protocol in Windows operating systems. This vulnerability is associated with a violation of the data protection mechanism. Exploitation of the vulnerability may allow an attacker to bypass existing security restrictions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a security feature bypass vulnerability in the implementation of the Secure Boot protocol in Windows operating systems. This vulnerability is associated with a violation of the data protection mechanism. Exploitation of the issue may allow an attacker to bypass existing security restrictions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows (affected versions not specified) **Description** The issue is related to a security feature bypass vulnerability in the BitLocker data protection function of the Microsoft Windows operating system. This vulnerability is associated with a disruption in the data protection mechanism. Exploitation of this issue may allow an attacker to bypass existing security restrictions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a buffer overflow in the Secure Boot protocol implementation, which can be exploited to bypass security restrictions. This could allow an attacker to affect the system. No information is provided about the estimated number of potentially affected devices or real-world incidents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows 11 (affected versions not specified) Windows 10 (affected versions not specified) Windows Server 2022 (affected versions not specified) **Description** A security feature bypass in the BitLocker data protection function allows an attacker with physical access to an unpatched PC to bypass existing security restrictions and encryption. **Recommendations** For Windows 11, apply the Latest Cumulative Update (LCU). For Windows 10, install update KB5034441. For Windows Server 2022, install update KB5034439.

**Name of the Vulnerable Software and Affected Versions** Windows versions prior to the July 9, 2024 updates **Description** A security-feature bypass issue exists in the Windows Secure Boot implementation due to errors in accessing debugging functions during the boot process. This flaw allows an attacker to bypass existing security restrictions. Specifically, the issue can be exploited by triggering a boot error to read the BitLocker decryption key from memory, as the bootloader fails to clear it. Furthermore, attackers can downgrade the bootloader to a vulnerable version to exploit this memory reading flaw, even on fully updated Windows 11 systems with Secure Boot enabled. This vulnerability has been linked to the deployment of UEFI bootkits by the FishMonger threat group to ensure persistence and stealth on targeted government systems. **Recommendations** Update Windows to the version released on or after July 9, 2024. Deploy the updated UEFI CA certificates to the system. Revoke the 2011 CA certificates and enforce the Secure Boot Security Version Number (SVN). As a temporary mitigation, suspend BitLocker and disable Secure Boot in the BIOS/UEFI settings.

**Name of the Vulnerable Software and Affected Versions** Windows Boot Manager (affected versions not specified) **Description** The issue is related to errors in security settings of the Windows Boot Manager, allowing an attacker to bypass security restrictions. This can potentially affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Boot Manager (affected versions not specified) **Description** The issue is related to errors in security settings of the Windows Boot Manager, allowing an attacker to bypass security restrictions. This can potentially affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Boot Manager (affected versions not specified) **Description** The issue is related to a security feature bypass in the Windows Boot Manager of Microsoft Windows operating systems. This could allow an attacker to bypass the BitLocker device encryption feature and access encrypted data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows BitLocker (affected versions not specified) **Description** A security-feature bypass issue exists in the Windows BitLocker component caused by a race condition, which occurs when multiple processes attempt to access the same resource simultaneously. This flaw allows an attacker with brief physical access and network connectivity to bypass encryption and gain unauthorized access to protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows (affected versions not specified) **Description** The issue is related to errors in security settings, allowing an attacker to bypass the authentication process. It is a security-feature bypass vulnerability that enables attackers to affect the system. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Boot Manager (affected versions not specified) **Description** The issue is related to a security feature bypass in the Windows Boot Manager, which is associated with insufficient access control. This could allow an attacker to bypass existing security restrictions. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows 11 (affected versions not specified) **Description** A security feature bypass allows attackers to circumvent Secure Boot, enabling the installation of UEFI bootkits such as BlackLotus. This issue is exploited by deploying vulnerable signed binary files into the EFI system partition, which allows the attacker to register a malicious Machine Owner Key (MOK) in the `MokList` and NVRAM variables. Once established, the attacker can use legitimate Microsoft-signed firmware to launch a self-signed bootkit. This level of persistence allows the malware to control the operating system boot process and disable security mechanisms including Hypervisor-Protected Code Integrity (HVCI) and BitLocker. The bootkit may also deploy an HTTP loader to communicate with command-and-control servers for executing commands and loading additional payloads. Technical artifacts are often dropped in the `EFIMicrosoftBootsystem32` path. **Recommendations** Reinstall Windows and use the `mokutil` utility to remove the registered malicious MOK key. Disable vulnerable UEFI binary files used to bypass Secure Boot. Update the Secure Boot DBX (revocation list) to ensure signed-but-vulnerable bootloaders are blocked. As a temporary mitigation, use `fwupdmgr` to refresh metadata and upgrade firmware to verify checksums and apply available updates.