Clevo UEFI Leak Allows Signing of Malicious Firmware with BootGuard Keys

Clevo’s UEFI update package exposed private signing keys tied to Intel Boot Guard, enabling attackers to sign malicious firmware that would be trusted in the earliest boot stages. The issue is tracked as Vulnerability Note VU#538470 and was published on 13 October 2025, with the story noted in a report dated 14 October 2025. According to CERT Vulnerability Note VU#538470, an attacker who can write to the system’s SPI flash could sign a tampered firmware image that the platform would treat as legitimate and boot.

The exposure potentially extends beyond Clevo-branded devices into the supply chain, as Clevo builds firmware and hardware for multiple brands, and CERT’s vendor list shows several core ecosystem players reported as not affected. The recommendation is to inventory affected models and firmware versions, confirm whether Clevo’s Boot Guard implementation is present, and apply updates only from verified sources while tightening firmware write protections where possible.

The disclosure was carried out by the Binarly Research Team, with initial reporting by Thierry Laurion, and defenders are urged to expand integrity monitoring to include firmware baselines and SPI flash write events.