Clevo

A significant security breach has occurred affecting multiple gaming laptop models using Clevo hardware, where Boot Guard private keys were exposed in firmware updates. This vulnerability enables attackers to bypass security protections, potentially installing malicious firmware. The exposure of private cryptographic keys compromises the integrity of the device's boot process, a cornerstone for system security. Manufacturers like Gigabyte and XPG are affected, with devices such as the Gigabyte G6X 9KG released in early 2025 being vulnerable. This incident has widespread implications for the affected companies, possibly damaging their reputation and consumer trust. Despite reporting to CERT/CC, swift and efficient remediation is hampered, indicating a notable impact on the firmware supply chain security.

Source: https://cybersecuritynews.com/clevo-devices-boot-guard-private-key/

TPRM report: https://scoringcyber.rankiteo.com/company/clevo

"id": "cle504032625",
"linkid": "clevo",
"type": "Vulnerability",
"date": "3/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'Electronics',
                        'name': 'Gigabyte',
                        'type': 'Manufacturer'},
                       {'industry': 'Electronics',
                        'name': 'XPG',
                        'type': 'Manufacturer'}],
 'attack_vector': 'Firmware Update',
 'data_breach': {'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Private cryptographic keys'},
 'description': 'A significant security breach has occurred affecting multiple '
                'gaming laptop models using Clevo hardware, where Boot Guard '
                'private keys were exposed in firmware updates. This '
                'vulnerability enables attackers to bypass security '
                'protections, potentially installing malicious firmware. The '
                'exposure of private cryptographic keys compromises the '
                "integrity of the device's boot process, a cornerstone for "
                'system security. Manufacturers like Gigabyte and XPG are '
                'affected, with devices such as the Gigabyte G6X 9KG released '
                'in early 2025 being vulnerable. This incident has widespread '
                'implications for the affected companies, possibly damaging '
                'their reputation and consumer trust. Despite reporting to '
                'CERT/CC, swift and efficient remediation is hampered, '
                'indicating a notable impact on the firmware supply chain '
                'security.',
 'impact': {'brand_reputation_impact': 'Possible damage to reputation and '
                                       'consumer trust',
            'systems_affected': 'Multiple gaming laptop models using Clevo '
                                'hardware'},
 'response': {'remediation_measures': 'Reporting to CERT/CC'},
 'title': 'Clevo Hardware Boot Guard Private Key Exposure',
 'type': 'Security Breach',
 'vulnerability_exploited': 'Exposed Boot Guard private keys'}