CVE-2024-7344

EUVD-2024-48259
Howyar UEFI Application "Reloader"  (32-bit and 64-bit)  is vulnerable to execution of unsigned software in a hardcoded path.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.2 HIGH
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA-ADPADP
8.2 HIGH
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 59%
Affected Products (NVD)
VendorProductVersion
cs-grpneo_impact
𝑥
< 10.1.024-20241127
greenwaregreenguard
𝑥
< 10.2.023-20240927
howyarsysreturn
𝑥
< 10.2.023_20240919
radixsmart_recovery
𝑥
< 11.2.023-20240927
sanfongez-back_system
𝑥
< 10.3.024-20241127
signalcomputerhdd_king
𝑥
< 10.3.021-20241127
wasayerecoveryrx
𝑥
< 8.4.022-20241127
𝑥
= Vulnerable software versions
Windows Releases
Platform
Version
Windows 10
(x64, x86)
KB5050013
1607 (x64, x86)
KB5049993
1809 (x64, x86)
KB5050008
21H2 (arm64, x64, x86)
KB5049981
22H2 (arm64, x64, x86)
KB5049981
Windows 11
22H2 (arm64, x64)
KB5050021
23H2 (arm64, x64)
KB5050021
24H2 (arm64, x64)
KB5050009
Windows Server 2012
Server Core
KB5050004
Standard
KB5050004
Windows Server 2012 R2
Server Core
KB5050048
Standard
KB5050048
Windows Server 2016
Server Core
KB5049993
Standard
KB5049993
Windows Server 2019
Server Core
KB5050008
Standard
KB5050008
Windows Server 2022
23H2 Server Core
KB5049984
Server Core
KB5049983
Standard
KB5049983
Windows Server 2025
Server Core
KB5050009
Standard
KB5050009
Common Weakness Enumeration
References
https://uefi.org/revocationlistfile
https://uefi.org/specs/UEFI/2.10/03_Boot_Manager.html
https://uefi.org/specs/UEFI/2.10/32_Secure_Boot_and_Driver_Signing.html
https://www.eset.com/blog/enterprise/preparing-for-uefi-bootkits-eset-discovery-shows-the-importance-of-cyber-intelligence/
https://www.kb.cert.org/vuls/id/529659
https://www.kb.cert.org/vuls/id/529659
https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/