CVE-2024-0762

highpriority · track · 41EPSS 0.008 · 55 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

2 exploits · PoC

Likely / severe?

0.76% (55th) EPSS

CVSS 7.8 · high

Is it mine?

29 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Potential buffer overflow in unsafe UEFI variable handling in Phoenix SecureCore™ for select Intel platforms This issue affects: Phoenix SecureCore™ for Intel Kaby Lake: from 4.0.1.1 before 4.0.1.998; Phoenix SecureCore™ for Intel Coffee Lake: from 4.1.0.1 before 4.1.0.562; Phoenix SecureCore™ for Intel Ice Lake: from 4.2.0.1 before 4.2.0.323; Phoenix SecureCore™ for Intel Comet Lake: from 4.2.1.1 before 4.2.1.287; Phoenix SecureCore™ for Intel Tiger Lake: from 4.3.0.1 before 4.3.0.236; Phoenix SecureCore™ for Intel Jasper Lake: from 4.3.1.1 before 4.3.1.184; Phoenix SecureCore™ for Intel Alder Lake: from 4.4.0.1 before 4.4.0.269; Phoenix SecureCore™ for Intel Raptor Lake: from 4.5.0.1 before 4.5.0.218; Phoenix SecureCore™ for Intel Meteor Lake: from 4.5.1.1 before 4.5.1.15.

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.9

v3.17.5highAV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondaryexploitability 0.8 · impact 6

v3.17.4highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-119USCWE-120USCWE-120US

exploits (2)

Public proof-of-concept and weaponised exploit code.

abandon1337/CVE-2024-0762UEFIcanhazbufferoverflowPoC · poc_in_github
tadash10/Detect-CVE-2024-0762Detecting vulnerabilities like CVE-2024-0762, particularly in UEFI firmware, is quite challenging due to the low-level nature PoC · poc_in_github

affected products (29)

Products and version ranges known to be affected.

Lenovo Computerall versionscert_bundDEcpe:/h:lenovo:computer:-
Phoenix Technologies BIOSall versionscert_bundDEcpe:/a:phoenix:securecore_technology:-
Phoenix SecureCore™ for Intel Alder Lake4.4.0.1 → 4.4.0.269enisa_euvdEU
Phoenix SecureCore™ for Intel Coffee Lake4.1.0.1 → 4.1.0.562enisa_euvdEU
Phoenix SecureCore™ for Intel Comet Lake4.2.1.1 → 4.2.1.287enisa_euvdEU
Phoenix SecureCore™ for Intel Ice Lake4.2.0.1 → 4.2.0.323enisa_euvdEU
Phoenix SecureCore™ for Intel Jasper Lake4.3.1.1 → 4.3.1.184enisa_euvdEU
Phoenix SecureCore™ for Intel Kaby Lake4.0.1.1 → 4.0.1.998enisa_euvdEU
Phoenix SecureCore™ for Intel Meteor Lake4.5.1.1 → 4.5.1.15enisa_euvdEU
Phoenix SecureCore™ for Intel Raptor Lake4.5.0.1 → 4.5.0.218enisa_euvdEU
Phoenix SecureCore™ for Intel Tiger Lake4.3.0.1 → 4.3.0.236enisa_euvdEU
Phoenix Technologies Inc. SecureCore4.0.1.1 → 4.0.1.998fstec_bduRU
Phoenix Technologies Inc. SecureCore4.1.0.1 → 4.1.0.562fstec_bduRU
Phoenix Technologies Inc. SecureCore4.2.0.1 → 4.2.0.323fstec_bduRU
Phoenix Technologies Inc. SecureCore4.2.1.1 → 4.2.1.287fstec_bduRU
Phoenix Technologies Inc. SecureCore4.3.0.1 → 4.3.0.236fstec_bduRU
Phoenix Technologies Inc. SecureCore4.3.1.1 → 4.3.1.184fstec_bduRU
Phoenix Technologies Inc. SecureCore4.4.0.1 → 4.4.0.269fstec_bduRU
Phoenix Technologies Inc. SecureCore4.5.0.1 → 4.5.0.218fstec_bduRU
Phoenix Technologies Inc. SecureCore4.5.1.1 → 4.5.1.15fstec_bduRU

showing 20 of 29

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-1435Phoenix Technologies BIOS: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit AdministratorrechtenDeutsch2024-06-23csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in Phoenix Technologies BIOS ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2024-05-14modified 2026-06-17

references (14)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan