An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker to control its value, leading to arbitrary memory writes, including modification of critical firmware settings stored in NVRAM. Exploiting this vulnerability could enable security bypasses, persistence mechanisms, or full system compromise.
PoC: TALKINGEBN
planned to be a root kit that is ingrained inside of the UEFI bootloader, but first does priviliage escalation and will be constantly update with probably a c2 server and anti EDR and AV's prevention measures for it to be real world applicable malware (looking for CVE-2025-3052)
PoC: CVE-2025-3052
Research on CVE-2025-3052, an Insyde firmware vulnerability that exposes an arbitrary write primitive capable of modifying security-critical pointers.
PoC: talkingBen
planned to be a root kit that is ingrained inside of the UEFI bootloader, but first does priviliage escalation and will be constantly update with probably a c2 server and anti EDR and AV's prevention measures for it to be real world applicable malware (looking for CVE-2025-3052)
PoC: talkingBen
planned to be a root kit that is ingrained inside of the UEFI bootloader, but first does priviliage escalation and will be constantly update with probably a c2 server and anti EDR and AV's prevention measures for it to be real world applicable malware (looking for CVE-2025-3052)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free