CVE-2025-11577: Clevo Notebook System Firmware

High severity, CVSS 7.6. EPSS: 0.3% chance of exploitation in the next 30 days.

Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Policy Manifest verification. The exposure of these keys could allow attackers to sign malicious firmware that appears trusted by affected systems, undermining the integrity of the early boot process.

Affected products

• Clevo Notebook System Firmware: version 1.07.07TRO1 only

Published 2025-10-14. Last modified 2026-10-08.