VU#616257: Microsoft-signed UEFI shim bootloaders vulnerable to Secure Boot bypass
2026-06-09T20:52:14Z•05cd300a3be156ed8d1a33845944c17a4fe64d737c0c8203a5896c6374bf2ed8
AppsmithBYOVDChrome extensionCodeMirrorCollibraDBXIMSIPsecSIPSQL-autocompleteSecure BootSecurlyUEFIVoLTEXSSZipSlipaccess-controlauthentication-bypass','IAM','Casdoor','kernel-driver','PCTCore4hardcoded-keysintegrity-protectionpath-traversalremote-code-executionshimstored-XSSweak-cryptography
What happened
This collection of CERT/CC vulnerability notes describes multiple high-impact issues across firmware, browser extensions, telecom IMS, web apps, enterprise agents, kernel drivers, and IAM platforms. Key findings include: Microsoft-signed UEFI shim bootloaders (<=0.9) vulnerable to Secure Boot bypass via BYOVD techniques (will be mitigated by adding affected shims to Microsoft’s UEFI Forbidden Signature DB/DBX); Securly Chrome Extension (v3.0.7) with insecure HTTP fetches, hardcoded AES passphrases, and unauthenticated endpoints exposing sensitive data (multiple CVEs); Verizon VoLTE IMS SIP was
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- 05cd300a3be156ed8d1a33845944c17a4fe64d737c0c8203a5896c6374bf2ed8
- Enrichment time
- 2026-06-09T20:52:14Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.