CVE-2025-11577 — HIGH (7.6)

Vulnerability Description

Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Policy Manifest verification. The exposure of these keys could allow attackers to sign malicious firmware that appears trusted by affected systems, undermining the integrity of the early boot process.

CVSS Score

7.6

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

References

FAQ

What is CVE-2025-11577?

CVE-2025-11577 is a vulnerability with a CVSS score of 7.6 (HIGH). Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Policy Manifest verification. The exposure of these keys could al...

How severe is CVE-2025-11577?

CVE-2025-11577 has been rated HIGH with a CVSS base score of 7.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-11577?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.