Skip to content
OpenAdvisories
High · 7.8 Public exploit CVE-2025-4275 EUVD-2025-18070GHSA-v9r5-7mg9-fwrr

SecureFlashDxe: Incorrect UEFI variable attributes check allows usage of invalid certificate

Published Jun 11, 2025 · Updated Aug 14, 2025 · Assigned by Insyde

Vendor: Insyde Software Product: InsydeH2O

Description

A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verification by creating a non-authenticated NVRAM variable. An attacker may to execute arbitrary signed UEFI code and bypass Secure Boot.

Affected products

VendorProductAffectedFixed
Insyde Software InsydeH2O Kernel 5.2 – < 05.2A.16, Kernel 5.3 – < 05.39.16, Kernel 5.4 – < 05.47.16, Kernel 5.5 – < 05.55.16, Kernel 5.6 – < 05.62.16, Kernel 5.7 – < 05.71.16 05.2A.16

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

  • NikolajSchlej/Hydroph0bia ★ 42 · Jun 10, 2025

    Binaries, drivers, PoCs and other stuff on Hydroph0bia vulnerability (CVE-2025-4275)

  • Dorlander/hydrophobia-scanner ★ 0 · Oct 22, 2026

    Read-only defender scanner for CVE-2025-4275 (Hydroph0bia) on Insyde H2O firmware. Companion to Insyde SA-2025002 / CERT/CC VU#211341.

  • TheMalwareGuardian/CVE-2025-4275 ★ 0 · Jan 12, 2026

    Analysis and exploitation of CVE-2025-4275 (Hydr0ph0bia), a Secure Boot trust-chain weakness where firmware variables are used to introduce attacker-controlled certificates trusted by subsequent boot…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References