Medium severity6.7NVD Advisory· Published Aug 26, 2022· Updated Jun 17, 2026
CVE-2022-34302
CVE-2022-34302
Description
A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
24- cpe:2.3:o:horizondatasys:uefi_bootloader:*:*:*:*:*:*:*:*Range: <2022-06-01
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2016:20h2:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
- New Horizon Datasys/bootloadersdescription
- Range: <2022-06-01
- osv-coords3 versions
< 1.8.10-2.el9.alma+ 2 more
- (no CPE)range: < 1.8.10-2.el9.alma
- (no CPE)range: < 1.8.10-2.el9.alma
- (no CPE)range: < 1.8.10-2.el9.alma
Patches
Vulnerability mechanics
References
3- edk2-docs.gitbook.io/understanding-the-uefi-secure-boot-chain/secure_boot_chain_in_uefi/uefi_secure_bootnvdThird Party Advisory
- www.kb.cert.org/vuls/id/309662nvdThird Party AdvisoryUS Government Resource
- www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01001.htmlnvd
News mentions
1- Forgotten UEFI shims undermining Secure BootESET WeLiveSecurity · Jul 14, 2026