CVE-2023-48733

What it actually does

The misconfiguration leaves the UEFI Shell enabled by default in EDK2-based firmware, allowing an OS-resident process with administrative privileges to launch the shell and interact directly with boot services, EFI variables, and loaders outside of Secure Boot enforcement.

Why it matters to the business

Attackers who already have operating-system access can load and execute code that bypasses the platform's verified boot chain, undermining trust in the entire system startup process and potentially enabling persistent malware that survives OS reinstalls.

How an attack unfolds

An attacker first obtains administrative access to the running operating system, then invokes the enabled UEFI Shell from user space, uses it to disable or bypass Secure Boot policy, and finally loads an unsigned or malicious bootloader or kernel image that executes with platform privileges.

How to fix it

Disable the UEFI Shell in the firmware configuration or apply a firmware update that removes the insecure default; verify that Secure Boot remains enforced after any change and restrict administrative access to boot-related tools.

How to confirm the fix worked

Inspect current firmware settings for UEFI Shell availability, attempt to launch the shell from an administrative OS session, and confirm that Secure Boot policy blocks unsigned loaders after remediation.

Typical attack path

1. Gain local administrative access to the operating system
2. Execute or invoke the UEFI Shell binary from within the OS
3. Use shell commands to modify EFI variables or boot options
4. Load and execute unsigned code that bypasses Secure Boot verification
5. Establish persistence via modified boot chain or firmware settings

How to detect it

Review system and firmware logs for invocations of the UEFI Shell, unexpected changes to EFI boot variables, or attempts to load unsigned images; correlate with administrative OS sessions and boot-time events.

What your security team should do

• Immediately audit firmware configurations across all affected systems for enabled UEFI Shell
• Apply any available EDK2 firmware updates that correct the default setting
• Enforce least-privilege access so that only trusted administrators can interact with boot services
• Monitor boot logs and EFI variable changes for unexpected modifications