What’s Vulnerable › Vulnerabilities
CVE-2024-7344: Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.
- Severity: high (CVSS 8.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-01-14 · updated 2026-06-17
- Weakness: CWE-347
Description
Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.
Affected products
- Cs-Grp Neo Impact: before 10.1.024-20241127 — fixed in 10.1.024-20241127
- Greenware Greenguard: before 10.2.023-20240927 — fixed in 10.2.023-20240927
- Howyar Sysreturn: before 10.2.023_20240919 — fixed in 10.2.023_20240919
- Radix Smart Recovery: before 11.2.023-20240927 — fixed in 11.2.023-20240927
- SANFONG Ez-Back System: before 10.3.024-20241127 — fixed in 10.3.024-20241127
- SignalComputer HDD King: before 10.3.021-20241127 — fixed in 10.3.021-20241127
- Wasay Erecoveryrx: before 8.4.022-20241127 — fixed in 8.4.022-20241127
How to fix
Upgrade to a fixed version: Cs-Grp Neo Impact 10.1.024-20241127; Greenware Greenguard 10.2.023-20240927; Howyar Sysreturn 10.2.023_20240919; Radix Smart Recovery 11.2.023-20240927; SANFONG Ez-Back System 10.3.024-20241127; SignalComputer HDD King 10.3.021-20241127; Wasay Erecoveryrx 8.4.022-20241127. Check the vendor advisory for mitigations.
References
- https://uefi.org/revocationlistfile
- https://uefi.org/specs/UEFI/2.10/03_Boot_Manager.html
- https://uefi.org/specs/UEFI/2.10/32_Secure_Boot_and_Driver_Signing.html
- https://www.eset.com/blog/enterprise/preparing-for-uefi-bootkits-eset-discovery-shows-the-importance-of-cyber-intelligence/
- https://www.kb.cert.org/vuls/id/529659
- https://www.kb.cert.org/vuls/id/529659
- https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/
Get alerted when CVE-2024-7344 or the next vulnerability affects your stack