VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot
CERT/CC details VU#718077: UEFI Shell embedded in SPI flash lets attackers bypass Secure Boot and execute pre-boot code; patches issued.
CERT/CC's VU#718077, reported by Eclypsium researcher Stas Lyakhov, describes how a UEFI Shell embedded in SPI flash can be abused by attackers who can modify UEFI boot configuration, creating multiple boot entries that bypass controls preventing the Shell from launching under Secure Boot. The Shell's dmem and mm commands allow arbitrary physical memory read/write, letting attackers overwrite Secure Boot values and execute unauthorized pre-boot code that can persist across reboots and OS reinstalls while degrading EDR effectiveness. AMI confirmed its Aptio UEFI BDS module is affected (CVE-2026-33197), and Cisco published an advisory for a variation affecting UCS Servers and UCS-based appliances (CVE-2026-20293). Firmware patches are being rolled out through OEM and IBV BIOS build pipelines.
- UEFI Shell in SPI flash allows boot-entry manipulation to bypass Secure Boot and execute pre-boot code.
- Exploitation requires attacker ability to modify UEFI boot entries, e.g., with root privileges.
- Pre-boot code can persist across reboots and OS reinstalls and reduce EDR effectiveness.
- AMI Aptio and Cisco UCS confirmed affected; vendor firmware patches are available.
- Enterprises advised to audit and monitor UEFI boot configuration changes.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20293 | Secure Boot Bypass via UEFI Shell in Cisco UCS Servers and UCS-based Appliances | 7.1 | <1% | ||
| CVE-2026-33197 | Privileged local BIOS code execution in AMI Aptio V (incomplete input validation) | 8.7 | <1% | ||
| CVE-2026-6485 | Secure Boot bypass via embedded UEFI Shell in UEFI BIOS firmware (CVE-2026-6485) | 8.2 | <1% |
From the original article
5 min read at kb.cert.orgOverview The UEFI Shell program may expose raw memory access capabilities that, if present in platform firmware for debugging or advanced support use cases, could be abused to undermine UEFI Secure Boot protections.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.