UEFI Shell Flaws Let Hackers Disable Secure Boot on Over 200,000 Laptops

Security researchers have found critical vulnerabilities in signed UEFI shells that allow attackers to bypass Secure Boot protections on approximately 200,000 Framework laptops and desktops. The flaws hinge on the mm command in many UEFI shells, which provides direct read and write access to system memory and can be used to overwrite security structures before the operating system loads.

Researchers demonstrated that targeting the Security Architectural Protocol enables attackers to neutralise Secure Boot while the system continues to report protections as active, enabling boot-time code such as bootkits and rootkits to run undetected. Framework has acknowledged the issue affecting roughly 200,000 devices and is rolling out fixes across its product line, with some models receiving limited shell versions and DBX database updates to blacklist vulnerable components.

The findings, according to Eclypsium, show that these are not merely theoretical threats and that attackers can exploit Microsoft-signed components sold openly in the market. Defence recommendations include keeping UEFI revocation lists updated through DBX, enabling BIOS password protection, managing Secure Boot keys, and using firmware analysis tools to identify vulnerable bootloaders.