SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20293

HIGH(7.1)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Risk Signal Score18/100 — NIEDRIG
  • CVSS 7.1 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.1%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.1

Technische Schwere

Beschreibung

A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access to an affected device to bypass UEFI Secure Boot validation checks and execute unauthorized software. This vulnerability is due to the availability of memory write commands in the UEFI Shell while UEFI Secure Boot is enabled on a device. An attacker could exploit this vulnerability by selecting the UEFI Shell boot option at boot time and using available shell commands to modify UEFI memory variables. A successful exploit could allow the attacker to manipulate the preboot environment, overwrite UEFI Secure Boot-related memory values, and execute unauthorized software on the affected device.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detection of unauthorized software execution or modification of UEFI memory variables in the preboot environment. This requires advanced logging and monitoring capabilities of the UEFI/BIOS.

Sentinel/Defender KQL

DeviceTvmSoftwareEvidenceVulnerabilities
| where CveId == "CVE-2026-20293"
| join kind=inner (DeviceProcessEvents
    | where FileName == "UEFIShell.efi" or ProcessCommandLine contains "memory write"
    | summarize LastObserved=max(Timestamp) by DeviceId, DeviceName, ProcessCommandLine
) on DeviceId
| project DeviceName, CveId, ProcessCommandLine, LastObserved, RemediationSteps

Splunk SPL

index=* sourcetype=uefi_logs (process="UEFIShell.efi" OR "memory write") | table _time, host, process, command

Sigma

title: Cisco UCS UEFI Secure Boot Bypass
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential exploitation of CVE-2026-20293 by monitoring UEFI Shell activity related to memory write commands.
author: SecBoard
date: 2026/09/08
logsource:
  product: uefi
  service: logs
detection:
  selection:
    - Image|endswith: '\UEFIShell.efi'
    - CommandLine|contains: 'memory write'
  condition: selection
level: high

Elastic ES|QL

from logs
| where event.dataset == "uefi.logs"
| where process.executable == "UEFIShell.efi" or process.command_line : "memory write"
| select @timestamp, host.name, process.executable, process.command_line

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen