{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-3052 exists.","fix":"No fix has been published for CVE-2025-3052 yet. Limit exposure of the affected software until one is available.","what":"CVE-2025-3052 is a high-severity memory corruption vulnerability in DT Research BiosFlashShell, published on 10 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-3052 and fix it if it is affected.\n\nWhat it is: CVE-2025-3052 is a high-severity memory corruption vulnerability in DT Research BiosFlashShell, published on 10 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-3052 exists.\n\nAffected product: DT Research BiosFlashShell. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-3052/ (Markdown: https://insights.sbomify.com/CVE-2025-3052/index.md)","id":"CVE-2025-3052","markdown":"https://insights.sbomify.com/CVE-2025-3052/index.md","name":"CVE-2025-3052","record":{"aliases":["GHSA-q4rv-v64c-3hff"],"analysis":{"component_type":"hardware_firmware","fix_type":"patch","impacts":["code_execution","security_bypass"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"UEFI firmware","requires_auth":"high_privilege","summary":"An arbitrary write vulnerability in DT Research UEFI firmware allows attackers to execute untrusted code and compromise the system.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"certcc","cpe":[],"cvss":{"score":8.2,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker to control its value, leading to arbitrary memory writes, including modification of critical firmware settings stored in NVRAM. Exploiting this vulnerability could enable security bypasses, persistence mechanisms, or full system compromise.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2025-10-31","github_poc":2,"max_poc_stars":1,"metasploit":0,"nuclei":0,"refs":[{"date":"2025-10-31T06:02:04Z","kind":"github_poc","ref":"https://github.com/m4rm0k/talkingBen","stars":1,"title":"planned to be a root kit that is ingrained inside of the UEFI bootloader, but first does priviliage escalation and will be constantly update with probably a c2 server and anti EDR and AV's prevention measures for it to be real world applicable malware (looking for CVE-2025-3052)"},{"date":"2026-01-09T10:51:48Z","kind":"github_poc","ref":"https://github.com/TheMalwareGuardian/CVE-2025-3052","stars":0,"title":"Research on CVE-2025-3052, an Insyde firmware vulnerability that exposes an arbitrary write primitive capable of modifying security-critical pointers."}],"tier":"weaponised"},"has_fix":null,"headline":"An arbitrary write vulnerability in Microsoft signed UEFI firmware from DT Research Inc.","id":"CVE-2025-3052","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2025"},"n_packages":0,"n_references":2,"next":{"headline":"Code injection in UiPress lite | Effortless custom dashboards, admin themes and pages","id":"CVE-2025-3053"},"packages":[],"prev":{"headline":"Linux::Statm::Tiny for Perl allows untrusted code to be included from the current working directory","id":"CVE-2025-3051"},"products":["BiosFlashShell","Dtbios"],"published":"2025-06-10","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-06-10","vendors":["DT Research"]},"summary":"An arbitrary write vulnerability in DT Research UEFI firmware allows attackers to execute untrusted code and compromise the system.","url":"https://insights.sbomify.com/CVE-2025-3052/"}