Message-ID: <8585a3bd-ac9f-438c-93c5-f11edd7a0786@syss.de>
Date: Fri, 12 Dec 2025 09:05:58 +0100
From: Micha Borrmann via Fulldisclosure <fulldisclosure@...lists.org>
To: <fulldisclosure@...lists.org>
Subject: [FD] [SYSS-2025-060]: HP computer UEFI boot protection bypass

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2025-060
Product:                   HP computer
Manufacturer:              HP
Affected Version(s):       Probably all HP computers
Tested Version(s):         zBook Firefly 14 inch G11 (BIOS W70 Ver.01.06.10)
Vulnerability Type:        CWE-288 (Authentication Bypass Using an 
Alternate Path or Channel)
Risk Level:                Low
Solution Status:           Open
Manufacturer Notification: 2025-10-28
Solution Date:             No solution
Public Disclosure:         2025-12-12
CVE Reference:             Not yet assigned
Author of Advisory:        Micha Borrmann, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

The UEFI boot menu of HP computers can be protected with an
administrator password. This can be set up using Administrator
Authentication Policies.

In order to boot from restricted boot devices, the set admin password
has to be entered in the one-time boot menu, which is usually
accessible by pressing the F9 key during system startup.

Many companies and government agencies protect their HP devices in
such a way.

However, this boot protection can be easily bypassed.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

It is possible to bypass the boot protection concerning legacy and
restricted boot devices, which is enabled when an admin password is
set in the HP UEFI.

Thus, an attacker can run other operating systems on the computer
system than the one intended by the system administrator, which may
result in exploit scenarios.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

If the computer is running Microsoft Windows, the authentication to
boot from an external boot medium can be bypassed via the Windows
Recovery Environment. With the default Windows settings, every user
can start the Windows Recovery Environment, for example by pressing
the shift key when triggering a system restart.

In the Windows Recovery Environment, there is an option called "Use a
device" to boot the system from an external medium (e.g., a USB flash
drive). If this option is selected, the system starts from the
external boot medium without requiring the set UEFI admin password.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

As of today, no solution is available.

As a measurement against unauthorized boot from external media, the
entire "USB Storage Boot" setting can be disabled in the UEFI (or
BIOS).

If on such a device anybody needs to boot from external media, the
administrator password (which should be known to boot from external
media) must be used to change the UEFI settings to enable "USB Storage
Boot". Afterwards, this setting has to be disabled again.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2025-10-28: Vulnerability discovered
2025-10-28: Vulnerability reported to manufacturer
2025-10-28: Vendor assigned a ticket number, but did not respond
2025-12-12: Public disclosure of vulnerability

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] SySS Security Advisory SYSS-2025-060
  
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-060.txt
[2] SySS Responsible Disclosure Policy
     https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Micha Borrmann of SySS GmbH.

E-Mail: micha.borrmann (at) syss.de
Public Key: 
https://www.syss.de/fileadmin/dokumente/PGPKeys/Micha_Borrmann.asc
Key ID: 0xCFC2D5B08EE0CBB9
Key Fingerprint: 38BD 7A9C 3EA9 39C5 33F9  94D0 CFC2 D5B0 8EE0 CBB9

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory
may be updated in order to provide as accurate information as
possible. The latest version of this security advisory is available on
the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEOL16nD6pOcUz+ZTQz8LVsI7gy7kFAmk2qWQACgkQz8LVsI7g
y7nPTxAAkyv5qBNcnabodl7RtoDseYYwEbK0K31PddOMDtovalQoijVaKtijaBx9
Q9eew9FdRb/mLOMW1ayhiQJXTzji/MP8WfDf5Lc+lYlm60GcqVKhRtqouBeGnrxl
nJKdlNa92w5US5mjzjmaxC31lLIa8zN+3188c2hM9Yj9fmNtk4GhPqvMvqP+8qE5
msdEAMw271+qRBc5x72S6TWmSaj9mi3x+ofGvz13SmSB9KO42q5O4OXE3IbOZoaa
ROGEUiJciAD/qSlNZlPO/L+VBD529RO2Eq53TkEx9QsYEf98okZS1ffofgafnp3F
wAVdqme9vSv3Vze2YTGGzaxHhGhcSutFM9XIhVrDNPA+Kx8Dd757p3nGdqWZXk4+
ERYiHnYiib2yQpMIydk7xCDsIkSnYaZsAg1g8P53lZpZAK82GLN1NzgRBlgMHArG
MTaxLNYjRbkk0RgdjiEjhfaMCLcSKiGN3n9NiGIx0Vf+hhCXnZH6HEIRCAgwmAaI
iOP6VaOeFcrKBLOZ5MDbTzEWr45uPVBlUOLe6JZ281e4Nc+SgKqBFUlpjI3ad8+q
ab6DLJYWQ7BC0wcJ48XYMzWLrUw6Bh8VZBZEGSfgszbUR56Q/4FzVW5vj0wD1n+7
LcqyzEnYKHxpsoOPYBKYm4cPWlmXzET80o4hBHXlw7LMpjpRITo=
=Volj
-----END PGP SIGNATURE-----
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists