CVE-2025-11577: Clevo UEFI Firmware Key Exposure Vulnerability

CVE-2025-11577 Overview

CVE-2025-11577 affects Clevo UEFI firmware update packages, including B10717.exe, which inadvertently contained private signing keys used for Intel Boot Guard and Boot Policy Manifest (BPM) verification. The exposed keys allow attackers to sign malicious firmware that affected systems treat as trusted. This breaks the root of trust established by Boot Guard and undermines the integrity of the early boot process. The vulnerability falls under the category of BIOS/UEFI and Secure Boot Bypass issues. Public references include the Binarly Security Advisory BRLY-2025-002 and CERT Vulnerability Advisory VUL-538470.

Critical Impact
Exposure of Boot Guard private keys enables attackers with physical or privileged access to install persistent, signed firmware implants that survive operating system reinstallation.

Affected Products

Clevo UEFI firmware update package B10717.exe
Clevo-manufactured systems shipping firmware signed with the leaked Boot Guard keys
OEM laptops based on affected Clevo barebone platforms

Discovery Timeline

2025-10-14 - CVE-2025-11577 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11577

Vulnerability Analysis

Intel Boot Guard establishes a hardware-anchored root of trust by verifying the Initial Boot Block (IBB) against an OEM Boot Policy Manifest signed with a private key. The corresponding public key hash is fused into the platform at manufacturing time. Clevo shipped firmware update packages that included the private signing material on the customer-distributable image. An attacker who extracts the keys can forge a Boot Policy Manifest and Key Manifest that the platform accepts as authentic. The forged manifests can then chain to attacker-controlled IBB code, defeating measured and verified boot guarantees.

Root Cause

The root cause is hardcoded cryptographic material packaged with publicly distributed firmware updates. Boot Guard private keys must remain confined to the OEM signing infrastructure. Their inclusion in B10717.exe and related updates collapses the asymmetric trust model into a shared secret accessible to anyone who downloads the update.

Attack Vector

Exploitation requires physical or administrative access to write firmware to the SPI flash. The attacker first extracts the leaked keys from the update package. The attacker then signs a malicious firmware image, including a tampered IBB and BPM, and flashes it to the target. The platform's Boot Guard logic validates the forged signatures against the fused key hash and continues execution. Because the implant lives below the operating system, it persists across OS reinstalls and most disk wipes. See the Binarly Security Advisory BRLY-2025-002 for the full technical analysis of the key extraction and signing process.

Detection Methods for CVE-2025-11577

Indicators of Compromise

Presence of B10717.exe or related Clevo firmware update binaries on endpoints or file shares
Unexpected SPI flash writes or firmware version changes on Clevo-based hardware
Boot Policy Manifest or Key Manifest entries signed with the leaked keys but not matching the OEM's current signing infrastructure
Firmware images whose Boot Guard manifests verify successfully but originate from non-OEM build pipelines

Detection Strategies

Inventory Clevo-based systems and capture firmware version, BPM, and KM hashes for offline comparison against known-good OEM values
Use firmware analysis tooling such as Binarly or CHIPSEC to validate Boot Guard manifest signatures and detect manifests signed with the leaked keys
Monitor administrative tooling such as flashrom, fpt.exe, and AfuWin for unauthorized invocation on production endpoints

Monitoring Recommendations

Alert on processes that read or write SPI flash regions, including kernel driver loads associated with firmware utilities
Track download and execution of Clevo firmware packages, particularly B10717.exe, across managed endpoints
Capture and centralize UEFI variables and TPM event logs to identify deviations from expected measured boot values

How to Mitigate CVE-2025-11577

Immediate Actions Required

Identify all Clevo-manufactured or Clevo-OEM systems in the environment and confirm their firmware version
Restrict local administrative privileges and physical access to high-value systems until OEM-revoked firmware is deployed
Enable full-disk encryption with TPM-bound keys so that firmware tampering invalidates platform attestation and triggers recovery flows

Patch Information

No vendor patch URL is provided in the NVD record at publication. Affected key material cannot be revoked through a firmware update alone because the Boot Guard public key hash is fused into the platform during manufacturing. Mitigation requires coordinated OEM action, including reissuing firmware signed with new keys on platforms that support key replacement, or hardware replacement on platforms where the fused key cannot be updated. Consult the CERT Vulnerability Advisory VUL-538470 and Binarly Security Advisory BRLY-2025-002 for the current list of impacted models and remediation guidance from Clevo.

Workarounds

Enforce BIOS administrator passwords and disable unauthenticated firmware update paths
Configure platform firmware to require signed capsule updates only and disable legacy flashing interfaces where supported
Deploy remote attestation using TPM PCR values to detect post-compromise firmware modification
Physically secure devices and apply tamper-evident seals on systems handling sensitive data

bash

# Example: capture TPM PCR values and firmware version for baseline comparison
tpm2_pcrread sha256:0,1,2,3,4,5,6,7
fwupdmgr get-devices --show-all