CVE Tools
Sign in

CVE-2024-8105

Insecure Platform Key (PK) used in UEFI system firmware signature

Published: Aug 26, 2024Updated: Jun 28, 2026 Sources: CVE List NVD BDU
6.4MEDIUM
NVD MITRE
EPSS Score
0.2%
Top 85.0%
CISA KEV
Not in KEV
Exploits
1 Known
Remediation
Patch Available
Self-Check
Not available

Description

A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.

No summary for this CVE yet.

CVSS Vector Breakdown

AV:LAC:HPR:HUI:NS:UC:HI:HA:H
Exploitability
AV:LAttack Vector
Local
AC:HAttack Complexity
High
PR:HPrivileges Required
High
UI:NUser Interaction
None
Scope
S:UScope
Unchanged
Impact
C:HConfidentiality
High
I:HIntegrity
High
A:HAvailability
High
Open in CVSS calculator →

Affected Products

Gigabyte
commercial·TWaka app center, aorus graphics engine, oc guru ii
E152-ZE1 (rev. A00)
Hardware Firmware
G152-Z12
Hardware Firmware
G242-Z11
Hardware Firmware
G242-Z12
Hardware Firmware
G262-ZR0
Hardware Firmware
G292-Z20 (rev. A00)
Hardware Firmware
G292-Z43
Hardware Firmware
G292-Z45
Hardware Firmware
Dell
commercial·USaka dell technologies
inspiron-15-3510-laptop
Hardware Firmware / printer-peripheral
alienware-x17-r2-laptopOn-prem
Enterprise Software / itsm-monitoring
alienware-m17-r4-laptopOn-prem
Enterprise Software / itsm-monitoring
alienware-x14-r1-laptopOn-prem
Enterprise Software / itsm-monitoring
alienware-aurora-r15-amd-desktop
Hardware Firmware / printer-peripheral
alienware-m17-r3-laptop
Hardware Firmware / printer-peripheral
alienware-area51m-r2-laptop
Hardware Firmware / printer-peripheral
alienware-x15-r1-laptopOn-prem
Enterprise Software / itsm-monitoring
Acer
commercial·TW
vz2694g
Networking Infrastructure
aspire s 27
Networking Infrastructure
aspire s32-1856
Networking Infrastructure
aspire xc-1710
Networking Infrastructure
c24-1655
Networking Infrastructure
aspire c22-1600
Networking Infrastructure
c24-962
Networking Infrastructure
altos r680 f4
Networking Infrastructure
Fujitsu
commercial·JPaka m10-1 firmware, m10-4s firmware, m10-4 firmware
AU47 M1
Hardware Firmware
PRIMERGY TX100 S3p
Hardware Firmware
PRIMERGY CX270 S2
Hardware Firmware
PRIMERGY CX420 S1 Chassis
Hardware Firmware
PRIMERGY RX100 S7p
Hardware Firmware
PRIMERGY TX120 S3p
Hardware Firmware
Aopen
commercial
iAPLx-DE(TAA30 TEST)Embedded
Hardware Firmware
iKBLMUx-DER(Volta Charging)Embedded
Hardware Firmware
Formelife
Studio Sys UPD
Web & CMS Plugins / site-builder
and 753 more affected products View all →

Exploitability

1 exploit source identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details
Official Patch Available
Is your org exposed to CVE-2024-8105?We can run the check for you — a free external exposure review, no install. Check my exposure

References

https://github.com/binarly-io/Vulnerability-REsearch/blob/main/PKfail/BRLY-2024-005.md
github.com
https://kb.cert.org/vuls/id/455367
kb.cert.org
https://security.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FJ-ISS-2024-072412-Security-Notice.pdf
security.ts.fujitsu.com
and 9 more references View all →
News mentions
Could not load news mentions.

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2024-8105 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows