Critical Supply Chain Flaw: Clevo UEFI Firmware Leaked Intel Boot Guard Private Keys (CVE-2025-11577)

The article reports a critical supply chain vulnerability, CVE-2025-11577, after researchers found Clevo’s UEFI firmware update packages exposed Intel Boot Guard private keys. According to CERT/CC, Clevo’s UEFI firmware update packages included sensitive private keys used in their Intel Boot Guard implementation, and the exposure could allow an attacker to sign malicious firmware that appears trusted by the system.

Intel Boot Guard is described as a platform integrity technology that verifies firmware before it runs, while Boot Guard is distinguished from UEFI Secure Boot, which enforces trust later in the boot chain. The piece notes that a compromise of Boot Guard could undermine downstream security measures, including Secure Boot and OS protections, because attackers could sign and install malicious firmware that passes the integrity checks.

Clevo has removed the affected firmware packages containing the leaked keys but has not announced a concrete mitigation or key revocation plan. It also highlights that Clevo’s firmware is used by various brands, broadening potential supply chain implications, and urges users to assess exposure, monitor for unsigned firmware changes, and rely on updates from trusted sources.