cbcvebase.
CVE-2023-24932
published 2023-05-09

CVE-2023-24932: Secure Boot Security Feature Bypass Vulnerability Secure Boot Security Feature Bypass Vulnerability

medium6.7CVSS 3.1
AVLACLPRHUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
10.56%
95.2th percentile
Secure Boot Security Feature Bypass Vulnerability Secure Boot Security Feature Bypass Vulnerability

Affected

54 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.2107310.0.10240.21073
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.824610.0.14393.8246
microsoftwindows_10_version_1809>= 10.0.0 < 10.0.17763.605410.0.17763.6054
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.755810.0.17763.7558
microsoftwindows_10_version_20h2>= 10.0.0 < 10.0.19042.296510.0.19042.2965
microsoftwindows_10_version_21h2>= 10.0.19044.0 < 10.0.19044.609310.0.19044.6093
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.609310.0.19045.6093
microsoftwindows_11_version_21h2>= 10.0.22000.0 < 10.0.22000.307910.0.22000.3079
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.562410.0.22621.5624
microsoftwindows_11_version_22h3>= 10.0.22631.0 < 10.0.22631.562410.0.22631.5624
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.562410.0.22631.5624
microsoftwindows_11_version_24h2>= 10.0.26100.0 < 10.0.26100.465210.0.26100.4652
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.7601.0 < 6.1.7601.278206.1.7601.27820
microsoftwindows_server_2008_service_pack_2>= 6.0.6003.0 < 6.0.6003.234186.0.6003.23418
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.255736.2.9200.25573
microsoftwindows_server_2012_r2>= 6.3.9600.0 < 6.3.9600.226766.3.9600.22676
microsoftwindows_server_2016>= 10.0.14393.0 < 10.0.14393.824610.0.14393.8246
microsoftwindows_server_2019>= 10.0.17763.0 < 10.0.17763.755810.0.17763.7558
microsoftwindows_server_2022>= 10.0.20348.0 < 10.0.20348.393210.0.20348.3932
microsoftwindows_server_2025>= 10.0.26100.0 < 10.0.26100.465210.0.26100.4652
msrcwindows_10
msrcwindows_10_version_1607
msrcwindows_10_version_1809
msrcwindows_10_version_1809_for_32-bit_systems
msrcwindows_10_version_1809_for_arm64-based_systems

Detection & IOCsextracted from sources · hover to see the quote

filenameKW1B5206BDC1743FP.dat
filenameKX1B5206BDC1743DD.dat
processvds.exe
processsvchost.exe
registryVSPMsg (Windows Print Processor registration)
hash9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
hash2915b3f8b703eb744fc54c81f4a9c67f
hash5616b94f1a40b49096e2f8f78d646891b45c649473a5b67b8beddac46ad398e1
hash3e10a74a7613d1cae4b9749d7ec93515
hashe4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934
hash93fefc3e88ffb78abb36365fa5cf857c
hash59f1e69b68de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa
hashdf11b3105df8d7c70e7b501e210e3cc3
hashe12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c
hasha087b2e6ec57b08c0d0750c60f96a74c
  • Hunt for unexpected or unrecognized .efi files on the EFI System Partition (ESP), or modifications to the BCD (Boot Configuration Data) store, which are primary indicators of BlackLotus/bootkit activity exploiting CVE-2023-24932.
  • Monitor for disabling of Memory Integrity (HVCI) or BitLocker, and audit logs for Secure Boot being disabled or tampered with — key post-exploitation signals of bootkit activity.
  • Query the UEFI Secure Boot DBX revocation list to verify that vulnerable boot manager signatures have been added; if DBX is not updated, the system remains exploitable even with Windows patches applied.
  • Detect WIN_DRV SprySOCKS persistence via scheduled tasks and Image File Execution Options (IFEO) hijacking on vds.exe; detect WIN_PLUS persistence via registration of a malicious Windows Print Processor named VSPMsg.
  • Detect WIN_DRV's TCP traffic diversion technique: the backdoor inspects incoming TCP traffic and redirects specially crafted packets to its listening port, allowing C2 without exposing the real listening port — look for unusual raw socket or port-forwarding activity.
  • Monitor for DLL side-loading chains initiated by a batch script that creates and executes a scheduled task — the initial delivery mechanism for WIN_DRV SprySOCKS components.
  • Audit the Windows Boot Manager version on all endpoints; a downgrade to an older, vulnerable bootmgr version (still signed by Microsoft but exploitable) is the core attack technique for CVE-2023-24932.
  • Detect mounting of the EFI System Partition (ESP) and replacement of boot files — a key step attackers take when installing BlackLotus or similar bootkits exploiting CVE-2023-24932.
  • ·Applying the CVE-2023-24932 patch alone is insufficient — administrators must also manually update the Secure Boot DBX revocation list to ban vulnerable boot managers. Skipping this step leaves systems exploitable via downgrade attacks even after patching.
  • ·The fix is disabled by default and is being rolled out in stages; enforcement is not expected until before 2026, with a six-month notice. Organizations must proactively opt in and test before enforcement.
  • ·Azure VMs and other virtual machines with Secure Boot enabled also require the extra manual remediation steps — the attack surface is not limited to physical hardware.

CVSS provenance

nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cvelistv56.7MEDIUM
vulncheck6.7MEDIUM
vendor_msrc8.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.