Critical 16-Year-Old UEFI Flaw Affects Network-Booting Servers

A critical vulnerability dating back 16 years has been identified in EDK II, the open-source framework that most hardware manufacturers use to build UEFI firmware. The flaw allows an attacker with network access during the boot process to execute arbitrary code before the operating system initializes.

UEFI firmware is the first software to run when a computer is powered on, preceding the operating system. The vulnerability specifically affects the network boot process, including iPXE and UEFI HTTP boot. An attacker who can reach the machine during this specific window could run code before Secure Boot initializes, potentially enabling firmware persistence and bypassing operating system-level security controls.

The flaw has existed within the EDK II codebase for 16 years. Because the attack is constrained to the network boot phase, the exploitation window is limited; once the operating system begins to load, the vulnerability no longer applies. However, successful exploitation could allow an attacker to establish persistence at the firmware level, which is difficult for operating systems and security tools to detect or remediate.

EDK II maintainers and hardware vendors are expected to release firmware updates to address the vulnerability. Until patches are applied, organizations are advised to evaluate the necessity of network boot functionality and implement network access controls to reduce the attack surface.