Every CVE Search/ Get API key

CVE-2024-8105

Insecure Platform Key (PK) used in UEFI system firmware signature

6.4 Medium

A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.27%Up 0.2 points since Aug 27, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.4

Insecure Platform Key (PK) used in UEFI system firmware signature

A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.

Record
CVE-2024-8105
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
EUVDEUVD-2024-48941 6.4

A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.

Record
EUVD-2024-48941
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-5xg9-v43g-xgcj 6.4

A vulnerability related to the use an insecure Platform Key (PK) has been discovered. An attacker...

A vulnerability related to the use an insecure Platform Key (PK) has been discovered. An attacker with the compromised PK private key can create malicious UEFI software that is signed with a trusted key that has been compromised.

Record
GHSA-5xg9-v43g-xgcj
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD 6.4

A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.

Record
CVE-2024-8105
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Show 731 moreShow less

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-8105 is a medium vulnerability (CVSS 6.4) in Acer Altos R680 F4, published August 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. No source names a fixed version.

References

Show 4 moreShow less
MoveEnter Open