CVE-2022-21894

MEDIUM

Secure Boot Security Feature Bypass Vulnerability

CVSS v3.1 Score

4.4
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack Vector
LOCAL
Complexity
LOW
Privileges
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE
Published: 1/11/2022Modified: 6/17/2026

Related Intelligence (1)

MEDIUMApt

How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.

CVE-2022-21894
Securelist (Kaspersky)

References (2)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21894https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21894