Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

BootROM Certificate Validation Flaw Allows Local Privilege Escalation

CVE-2022-38691 · published 1 year ago
Summary

A weakness in BootROM affects the way it handles certain certificates, which could allow an attacker to gain higher-level access on a local system without needing extra permissions. This affects systems using BootROM, and users should ensure their BootROM is updated with the latest security patches to prevent unauthorized access.

Original advisory text
In BootROM, there is a possible missing validation for Certificate Type 0. This could lead to local escalation of privilege with no additional execution privileges needed.
In BootROM, there is a possible missing validation for Certificate Type 0. This could lead to local escalation of privilege with no additional execution privileges needed.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-250Execution with Unnecessary Privileges
Timeline
Published1 Sep 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2022-38691 · NVD
Track software like this
Free during beta