CVE-2022-21894

Description from NVD

Secure Boot Security Feature Bypass Vulnerability.

Information Acquisition Date:2023-04-30T16:40Z

CVSS 2.0: 4.9 MEDIUM CVSS 3.x: 4.4 MEDIUM

▼ CVSS3 Vec CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Attack Vector (AV)	Network	Adjacent	Local	Physical
Attack Complexity (AC)	LOW	High
Privileges Required (PR)	None	Low	High
User Interaction (UI)	None	Required
Scope (S)	Unchange	Change
Confidentiality (C)	None	Low	High
Integrity (I)	None	Low	High
Availability (A)	None	Low	High

▼ CVSS2 Vec AV:L/AC:L/Au:N/C:N/I:C/A:N

Attack Vector (AV)	Network	Adjacent	Local
Access Complexity (AC)	Low	Medium	High
Authentication (Au)	None	Single	Multiple
Confidentiality (C)	None	Partial	Complete
Integrity (I)	None	Partial	Complete
Availability (A)	None	Partial	Complete

NVD References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21894
source:MISC
tags:Patch Vendor Advisory

This vulnerability may involve a PoC.

Refer to Information on External Sites

CVE Infomation	Exploits or more Infomation
mitre	EXPLOIT DATABASE
NVD	0day.today
vulmon.com	github
CVE Details	Twitter
JVN ENG JPN
Reconshell

Software Tag: Linux(1 tweets) Windows(7 tweets)

List of frequently cited URLs

URL	Num of Times Referred to
https://alerts.vulmon.com/?utm_source=twitter&utm_medium=so...	170
http://cyberiqs.com/latestnews	65
https://cvetrends.com	37
https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	33
https://buff.ly/3UtC48X	3
https://lnkd.in/eHSkq64b	3
https://github.com/Wack0/CVE-2022-21894	3
https://twitter.com/TheHackersNews/status/1646075703442526211	3
https://www.darkrelay.com/post/windows-11-s-secure-boot-def...	3
https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-b...	3

▼ Show Information from Twitter(89)

User	URL	Info Source	Date
SOC_Prime	https://socprime.com/blog/blacklotus-uefi-bootkit-detection...	Source SOC_Prime 1635668183121027074	2023/03/15
dark_relay2	https://www.darkrelay.com/post/windows-11-s-secure-boot-def...	Source dark_relay2 1635668820475133952	2023/03/15
dark_relay2	https://twitter.com/dark_relay2/status/1635668820475133952/...	Source dark_relay2 1635668820475133952	2023/03/15
SpixnetG	https://spixnet.at/cybersecurity-blog/2023/03/14/windows-11...	Source SpixnetG 1637432048217473029	2023/03/19
SpixnetG	https://twitter.com/SpixnetG/status/1637432048217473029/pho...	Source SpixnetG 1637432048217473029	2023/03/19
SpixnetG	https://spixnet.at/cybersecurity-blog/2023/03/14/windows-11...	Source SpixnetG 1637477144820428800	2023/03/20
SpixnetG	https://twitter.com/SpixnetG/status/1637477144820428800/pho...	Source SpixnetG 1637477144820428800	2023/03/20
ravirockks	https://www.binarly.io/posts/The_Untold_Story_of_the_BlackL...	Source ravirockks 1638339422759567361	2023/03/22
SpixnetG	https://www.spixnet.com/cybersecurity-blog/2023/03/14/windo...	Source SpixnetG 1639255286077870080	2023/03/24
SpixnetG	https://twitter.com/SpixnetG/status/1639255286077870080/pho...	Source SpixnetG 1639255286077870080	2023/03/24
StopMalvertisin	https://stpmvt.com/3ZYfnLw	Source StopMalvertisin 1645834230742515729	2023/04/12
ComputerPunks	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source ComputerPunks 1645834633140113409	2023/04/12
TheOnyxITGroup	http://dlvr.it/SmKR2f	Source TheOnyxITGroup 1645834646402502656	2023/04/12
TheOnyxITGroup	https://twitter.com/TheOnyxITGroup/status/16458346464025026...	Source TheOnyxITGroup 1645834646402502656	2023/04/12
AcooEdi	http://dlvr.it/SmKR78	Source AcooEdi 1645834655315394561	2023/04/12
AcooEdi	https://twitter.com/AcooEdi/status/1645834655315394561/photo/1	Source AcooEdi 1645834655315394561	2023/04/12
Alevskey	https://ift.tt/W7lMjix	Source Alevskey 1645836048771973124	2023/04/12
SK_Expert	https://ift.tt/OPgG91F	Source SK_Expert 1645837151903285267	2023/04/12
samilaiho	http://www.microsoft.com/en-us/security/blog/2023/04/11/gui...	Source samilaiho 1645839225726685184	2023/04/12
IT_securitynews	https://www.itsecuritynews.info/guidance-for-investigating-...	Source IT_securitynews 1645839864405819421	2023/04/12
DecipherSec	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source DecipherSec 1645840994900770835	2023/04/12
AllOffice365	https://buff.ly/3UtC48X	Source AllOffice365 1645845670463414272	2023/04/12
CyberIQs_	http://cyberiqs.com/latestnews	Source CyberIQs_ 1645848245644546048	2023/04/12
rodtrent	https://rodtrent.com/nmj	Source rodtrent 1645849760295796737	2023/04/12
tony_cleal	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source tony_cleal 1645856688027717636	2023/04/12
lukasberancz	https://twitter.com/i/web/status/1645857137774546963	Source lukasberancz 1645857137774546963	2023/04/12
PaulomorgadoN	http://dlvr.it/SmKm3P	Source PaulomorgadoN 1645865263634735104	2023/04/12
PaulomorgadoN	https://twitter.com/PaulomorgadoN/status/164586526363473510...	Source PaulomorgadoN 1645865263634735104	2023/04/12
CISACyber	http://cisa.gov/news-events/alerts/2023/04/11/microsoft-rel...	Source CISACyber 1645867204875898897	2023/04/12
Dinosn	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source Dinosn 1645882984434659329	2023/04/12
directorcia	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source directorcia 1645901474625466368	2023/04/12
sshzk	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source sshzk 1645903581126750208	2023/04/12
cybersec_nerd	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source cybersec_nerd 1645904217188745216	2023/04/12
reprise_99	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source reprise_99 1645933787921149952	2023/04/12
akaclandestine	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source akaclandestine 1645934568938041347	2023/04/12
cyberbiz4	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source cyberbiz4 1645935944732909568	2023/04/12
bmcder02	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source bmcder02 1645939056268935169	2023/04/12
ravirockks	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source ravirockks 1645944362512293889	2023/04/12
ravirockks	https://twitter.com/ravirockks/status/1645944362512293889/p...	Source ravirockks 1645944362512293889	2023/04/12
omvapt	https://vapt.me/TheBlackLotus	Source omvapt 1645949055174950914	2023/04/12
moton	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source moton 1645951388294479872	2023/04/12
Cyber_O51NT	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source Cyber_O51NT 1645968862037573632	2023/04/12
ikatzsolutions	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source ikatzsolutions 1645973411683008512	2023/04/12
ikatzsolutions	https://msrc.microsoft.com/update-guide/en-US/vulnerability...	Source ikatzsolutions 1645973411683008512	2023/04/12
EurekaBerry	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source EurekaBerry 1645983446974754816	2023/04/12
wrijugh	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source wrijugh 1645990120669999107	2023/04/12
__kokumoto	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source __kokumoto 1645993030003089408	2023/04/12
dhsdias	https://lnkd.in/dFsH6-ft	Source dhsdias 1646002653460135936	2023/04/12
omiossec_med	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source omiossec_med 1646015211432804352	2023/04/12
nicolaferrini	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source nicolaferrini 1646024620934561794	2023/04/12
nicolaferrini	https://twitter.com/nicolaferrini/status/164602462093456179...	Source nicolaferrini 1646024620934561794	2023/04/12
eyalestrin	https://ift.tt/lTki9ON	Source eyalestrin 1646050533289910274	2023/04/12
cyberproofinc	https://hubs.ly/Q01KwXDT0	Source cyberproofinc 1646060588525551617	2023/04/12
cyberproofinc	https://twitter.com/cyberproofinc/status/164606058852555161...	Source cyberproofinc 1646060588525551617	2023/04/12
ipssignatures	https://twitter.com/reprise_99/status/1645933787921149952	Source ipssignatures 1646062098626105345	2023/04/12
TheHackersNews	https://twitter.com/TheHackersNews/status/16460757034425262...	Source TheHackersNews 1646075703442526211	2023/04/12
golinkco	https://thehackernews.com/2023/04/urgent-microsoft-issues-p...	Source golinkco 1646079149419778048	2023/04/12
golinkco	https://twitter.com/TheHackersNews/status/16460757034425262...	Source golinkco 1646079149419778048	2023/04/12
JuanPCSur	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source JuanPCSur 1646095895186874369	2023/04/12
Harvesterify	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source Harvesterify 1646101386965164032	2023/04/12
ipssignatures	https://twitter.com/akaclandestine/status/1645934568938041347	Source ipssignatures 1646122498155528192	2023/04/12
ipssignatures	https://twitter.com/TheHackersNews/status/1646075703442526211	Source ipssignatures 1646122499216736258	2023/04/12
CVEtrends	https://cvetrends.com	Source CVEtrends 1646136095791251456	2023/04/12
autumn_good_35	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source autumn_good_35 1646139416828850177	2023/04/12
autumn_good_35	https://twitter.com/autumn_good_35/status/16461394168288501...	Source autumn_good_35 1646139416828850177	2023/04/12
Har_sia	https://har-sia.info/CVE-2022-21894.html	Source Har_sia 1646169679969304582	2023/04/13
OvidiuPismac	https://lnkd.in/dxhPCybE	Source OvidiuPismac 1646187003506044928	2023/04/13
GRComputers	https://www.bleepingcomputer.com/news/security/microsoft-sh...	Source GRComputers 1646198661733400583	2023/04/13
DragsterSystems	https://www.bleepingcomputer.com/news/security/microsoft-sh...	Source DragsterSystems 1646207021648076800	2023/04/13
DragsterSystems	https://twitter.com/DragsterSystems/status/1646207021648076...	Source DragsterSystems 1646207021648076800	2023/04/13
Har_sia	https://har-sia.info/CVE-2022-21894.html	Source Har_sia 1646218016227741696	2023/04/13
ArtyomSinitsyn	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source ArtyomSinitsyn 1646247853935697921	2023/04/13
madvirtualizer	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source madvirtualizer 1646267619928842242	2023/04/13
proficioinc	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source proficioinc 1646483382061154307	2023/04/13
manuelbissey	https://buff.ly/3UyQxQY	Source manuelbissey 1646499741721657344	2023/04/13
manuelbissey	https://twitter.com/manuelbissey/status/1646499741721657344...	Source manuelbissey 1646499741721657344	2023/04/13
Tinolle1955	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source Tinolle1955 1646518960744185859	2023/04/13
M_haggis	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source M_haggis 1646604855631552513	2023/04/14
admITeu	https://twitter.com/admITeu/status/1646609730201083907/photo/1	Source admITeu 1646609730201083907	2023/04/14
tobias_abele	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source tobias_abele 1646627452624445442	2023/04/14
infination	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source infination 1646701164816130048	2023/04/14
Cyberbay_HK	https://www.cyberbay.tech/blog/00d9da5b-fe5f-422d-8416-25f9...	Source Cyberbay_HK 1646740187827904512	2023/04/14
FookHwa	https://buff.ly/3UtC48X	Source FookHwa 1646825122743955456	2023/04/14
captainkirk_15	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source captainkirk_15 1647087305725804545	2023/04/15
nachpj	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source nachpj 1647653806656593920	2023/04/17
PatriotExperts	https://www.linkedin.com/feed/update/urn:li:activity:705374...	Source PatriotExperts 1647980762392850434	2023/04/18
lordman1982	https://buff.ly/3UtC48X	Source lordman1982 1648061304073080844	2023/04/18
CyberGuardNews	https://www.itsecuritynews.info/guidance-for-investigating-...	Source CyberGuardNews 1648171350165721092	2023/04/18
M_haggis	https://www.microsoft.com/en-us/security/blog/2023/04/11/gu...	Source M_haggis 1648400609320796163	2023/04/19

List of frequently cited URLs

URL	Num of Times Referred to
alerts.vulmon.com	170
cyberiqs.com	65
cvetrends.com	37
www.microsoft.com	33
buff.ly	3
lnkd.in	3
github.com	3
twitter.com	3
www.darkrelay.com	3
www.welivesecurity.com	3

▼ Show Information from Twitter(89)

User	URL	Info Source
SOC_Prime	socprime.com	Show Tweet
dark_relay2	darkrelay.com	Show Tweet
dark_relay2	twitter.com	Show Tweet
SpixnetG	spixnet.at	Show Tweet
SpixnetG	twitter.com	Show Tweet
SpixnetG	spixnet.at	Show Tweet
SpixnetG	twitter.com	Show Tweet
ravirockks	binarly.io	Show Tweet
SpixnetG	spixnet.com	Show Tweet
SpixnetG	twitter.com	Show Tweet
StopMalvertisin	stpmvt.com	Show Tweet
ComputerPunks	microsoft.com	Show Tweet
TheOnyxITGroup	dlvr.it	Show Tweet
TheOnyxITGroup	twitter.com	Show Tweet
AcooEdi	dlvr.it	Show Tweet
AcooEdi	twitter.com	Show Tweet
Alevskey	ift.tt	Show Tweet
SK_Expert	ift.tt	Show Tweet
samilaiho	microsoft.com	Show Tweet
IT_securitynews	itsecuritynews.info	Show Tweet
DecipherSec	microsoft.com	Show Tweet
AllOffice365	buff.ly	Show Tweet
CyberIQs_	cyberiqs.com	Show Tweet
rodtrent	rodtrent.com	Show Tweet
tony_cleal	microsoft.com	Show Tweet
lukasberancz	twitter.com	Show Tweet
PaulomorgadoN	dlvr.it	Show Tweet
PaulomorgadoN	twitter.com	Show Tweet
CISACyber	cisa.gov	Show Tweet
Dinosn	microsoft.com	Show Tweet
directorcia	microsoft.com	Show Tweet
sshzk	microsoft.com	Show Tweet
cybersec_nerd	microsoft.com	Show Tweet
reprise_99	microsoft.com	Show Tweet
akaclandestine	microsoft.com	Show Tweet
cyberbiz4	microsoft.com	Show Tweet
bmcder02	microsoft.com	Show Tweet
ravirockks	microsoft.com	Show Tweet
ravirockks	twitter.com	Show Tweet
omvapt	vapt.me	Show Tweet
moton	microsoft.com	Show Tweet
Cyber_O51NT	microsoft.com	Show Tweet
ikatzsolutions	microsoft.com	Show Tweet
ikatzsolutions	msrc.microsoft.com	Show Tweet
EurekaBerry	microsoft.com	Show Tweet
wrijugh	microsoft.com	Show Tweet
__kokumoto	microsoft.com	Show Tweet
dhsdias	lnkd.in	Show Tweet
omiossec_med	microsoft.com	Show Tweet
nicolaferrini	microsoft.com	Show Tweet
nicolaferrini	twitter.com	Show Tweet
eyalestrin	ift.tt	Show Tweet
cyberproofinc	hubs.ly	Show Tweet
cyberproofinc	twitter.com	Show Tweet
ipssignatures	twitter.com	Show Tweet
TheHackersNews	twitter.com	Show Tweet
golinkco	thehackernews.com	Show Tweet
golinkco	twitter.com	Show Tweet
JuanPCSur	microsoft.com	Show Tweet
Harvesterify	microsoft.com	Show Tweet
ipssignatures	twitter.com	Show Tweet
ipssignatures	twitter.com	Show Tweet
CVEtrends	cvetrends.com	Show Tweet
autumn_good_35	microsoft.com	Show Tweet
autumn_good_35	twitter.com	Show Tweet
Har_sia	har-sia.info	Show Tweet
OvidiuPismac	lnkd.in	Show Tweet
GRComputers	bleepingcomputer.com	Show Tweet
DragsterSystems	bleepingcomputer.com	Show Tweet
DragsterSystems	twitter.com	Show Tweet
Har_sia	har-sia.info	Show Tweet
ArtyomSinitsyn	microsoft.com	Show Tweet
madvirtualizer	microsoft.com	Show Tweet
proficioinc	microsoft.com	Show Tweet
manuelbissey	buff.ly	Show Tweet
manuelbissey	twitter.com	Show Tweet
Tinolle1955	microsoft.com	Show Tweet
M_haggis	microsoft.com	Show Tweet
admITeu	twitter.com	Show Tweet
tobias_abele	microsoft.com	Show Tweet
infination	microsoft.com	Show Tweet
Cyberbay_HK	cyberbay.tech	Show Tweet
FookHwa	buff.ly	Show Tweet
captainkirk_15	microsoft.com	Show Tweet
nachpj	microsoft.com	Show Tweet
PatriotExperts	linkedin.com	Show Tweet
lordman1982	buff.ly	Show Tweet
CyberGuardNews	itsecuritynews.info	Show Tweet
M_haggis	microsoft.com	Show Tweet

GitHub Search Results: Up to 10

Name	URL
Wack0/CVE-2022-21894	https://github.com/Wack0/CVE-2022-21894
ASkyeye/CVE-2022-21894-Payload	https://github.com/ASkyeye/CVE-2022-21894-Payload
Wack0/batondrop_armv7	https://github.com/Wack0/batondrop_armv7
qjawls2003/BlackLotus-Detection	https://github.com/qjawls2003/BlackLotus-Detection
bakedmuffinman/BlackLotusDetection	https://github.com/bakedmuffinman/BlackLotusDetection

GitHub Search Results: Up to 10

Name	URL
Wack0/CVE-2022-21894	github.com
ASkyeye/CVE-2022-21894-Payload	github.com
Wack0/batondrop_armv7	github.com
qjawls2003/BlackLotus-Detection	github.com
bakedmuffinman/BlackLotusDetection	github.com

2023/04/30 Score : 0
Added Har-sia Database : 2022/01/12
Last Modified : 2023/04/30
Highest Scored Date : 2023/04/12
Highest Score : 47