Vulnerabilitycritical
"Perfect" Windows downgrade attack turns fixed vulnerabilities into zero-days
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-21302 | Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability | 6.7 | 2% | ||
| CVE-2024-38202 | Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user… | 7.3 | 2% |
From the original article
3 min read at helpnetsecurity.com
A researcher has developed a downgrade attack that can make Windows machines covertly, persistently and irreversibly vulnerable, even if they were fully patched before that. The direction of SafeBreach researcher Alon Leviev’s probing was inspired by the BlackLotus UEFI bootkit , which was able to bypass the UEFI Secure Boot by exploiting a vulnerability, as well as disable Windows security mechanisms (e. g.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.