Source: thehackernews.com
A critical vulnerability discovered in EDK II, the widely-used open-source UEFI firmware codebase, has existed for approximately 16 years. The flaw allows an attacker to execute arbitrary code on a target machine before the operating system loads, effectively bypassing Secure Boot protections. The attack vector is limited to network-booting scenarios, meaning the machine must be performing a PXE or similar network boot for exploitation to occur. Since EDK II is used by most hardware manufacturers to build their UEFI firmware, the scope of affected devices is extremely broad. The vulnerability poses a significant risk to data centers, enterprise servers, and any environment where network booting is common. Exploitation could allow attackers to implant persistent firmware-level malware or rootkits that survive OS reinstallation. The age of the flaw suggests it may have been present and potentially exploitable in production environments for over a decade.
