CVE-2022-34302: Medium severity horizon datasys uefi bootloader vulnerability
A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-34302?
CVE-2022-34302 is a vulnerability found in New Horizon Datasys bootloaders that allows an attacker to bypass or tamper with Secure Boot protections.
How does CVE-2022-34302 affect the affected software?
CVE-2022-34302 affects various operating systems, including Horizondatasys Uefi Bootloader, Redhat Enterprise Linux, and Microsoft Windows 10, 11, and Server versions.
What is the severity of CVE-2022-34302?
The severity of CVE-2022-34302 is medium, with a CVSS score of 6.7.
How can an attacker exploit CVE-2022-34302?
An attacker can exploit CVE-2022-34302 by replacing the existing signed bootloader to load and execute arbitrary code in the pre-boot stage.
Is there a fix available for CVE-2022-34302?
A fix for CVE-2022-34302 may be provided by the software vendor or developer, and users should apply the latest patches or updates as soon as they are available.