Vulnerability · Published Oct 14, 2025 · Assigned by certcc
CVE-2025-11577Clevo UEFI firmware exposed Boot Guard private keys, enabling potential abuse of the Boot Guard trust chain
High 7.6
In plain English
A high-severity security flaw in Notebook System Firmware from Clevo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.3%top 82.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Policy Manifest verification. The exposure of these keys could allow attackers to sign malicious firmware that appears trusted by affected systems, undermining the integrity of the early boot process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Clevo | Notebook System Firmware | 1.07.07TRO1 |