Baton Drop
CVE-2022-21894Bypass Secure Boot and deploy UEFI bootkits on Windows systems.
A Secure Boot bypass vulnerability (CVE-2022-21894) affects many versions of Windows and Windows Server. It lets an attacker with physical access or admin privileges bypass Secure Boot, a feature that verifies only trusted software loads at startup, and install a persistent UEFI bootkit. The flaw is being actively exploited in targeted espionage campaigns, and Microsoft has released security updates.
Microsoft Windows 10 Version 1809 · Updated 28 Oct · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedNot listedThe US list of flaws under attack
SeveritymediumCVSS 4.4 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Windows 11 version 21H2 10.0 | 10.0.22000.434 |
| Windows Server 2022 10.0 | 10.0.20348.469 |
| Windows 10 Version 21H2 10.0 | 10.0.19044.1466 |
| Windows 10 Version 21H1 10.0 | 10.0.19043.1466 |
What to do
- Install the latest Windows updates to apply the fixed versions; for example, Windows 11 version 21H2 build 10.0.22000.434 or Windows 10 version 21H2 build 10.0.19044.1466.
- Ensure Secure Boot is enabled in your system's firmware settings.
- Monitor for signs of UEFI bootkit compromise, such as unusual boot behavior or detection by security tools.
- For organizations, follow Microsoft's advisory and apply updates to all affected systems.
What happened
- 24 OctKaspersky reports the BlackX UEFI bootkit exploiting Baton Drop in a Central Asia espionage campaign attributed to APT41.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2022-21894 | Secure Boot Security Feature Bypass Vulnerability | medium 4.4 | No | 6.8% |
Our reporting
24 OctNew BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot in Central Asia espionage campaignThe records
msrc.microsoft.com: advisory ↗CVE-2022-21894 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works