CVE-2017-5705VulnerabilityPublished 29 May 2025

Deguard: turning a T480 into a coreboot laptop (10-min talk + live demo)

Source Reddit NetSec

Not known to be exploited.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Low

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.6% chance of exploitation in 30 days – higher than 52% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
Public on cve.org; its publication date is not in this record
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Mitigation strategies should focus on a combination of technical controls and operational policies. First, organizations should inventory and identify devices running Intel ME 11.x firmware, particularly Lenovo T480/T480s and Dell OptiPlex 3050 models. Firmware updates from OEMs should be monitored and applied promptly if patches addressing CVE-2017-5705 or related vulnerabilities become available. Since no official patches are currently linked, organizations should engage with vendors for firmware security advisories. Employ hardware-based security modules or trusted platform modules (TPMs) to complement BootGuard protections and detect unauthorized firmware changes. Implement strict physical security controls to prevent unauthorized local access to devices, as exploitation requires local presence and technical manipulation. Use endpoint detection and response (EDR) solutions capable of monitoring firmware integrity and alerting on suspicious modifications. For organizations interested in open-source firmware, carefully evaluate the security trade-offs and ensure robust validation and signing processes are in place. Finally, maintain strong insider threat programs and user privilege management to reduce the risk of misuse of this capability.

Description

Intel BootGuard has kept most Skylake/Kaby-Lake/Coffee-Lake laptops locked away from coreboot – until now. At the end of 2024, Ubuntu developer Mate Kukri introduced **deguard**, a small utility that leverages **CVE-2017-5705** inside ME 11.x to *disable* BootGuard fuses in SRAM. The result: previously “un-coreboot-able” machines – e.g. **Lenovo T480/T480s** and **Dell OptiPlex 3050** – can boot unsigned firmware again. It has been presented and discussed at the **Dasharo Developers vPub 0xE**,

Impact

For European organizations, the impact of this threat is nuanced but important. Organizations relying on Lenovo T480/T480s and Dell OptiPlex 3050 devices, which are common in enterprise environments, could see their firmware security guarantees weakened. Disabling BootGuard allows unsigned firmware to run, which could be leveraged by attackers or insiders to install persistent, low-level malware that is difficult to detect or remove. This undermines the integrity and trustworthiness of the device's boot process, potentially compromising confidentiality and integrity of sensitive data. Although the exploit requires local access and technical expertise, it could facilitate advanced persistent threats (APTs) or insider attacks targeting critical infrastructure, government agencies, or enterprises with high security requirements. The ability to install coreboot or other open firmware could also be viewed positively by organizations seeking open-source firmware for transparency and security auditing, but it simultaneously lowers the barrier for malicious firmware modifications. Given the low severity rating and lack of known active exploitation, the immediate risk is limited, but the long-term implications for firmware security models and supply chain trust in affected devices are significant. European organizations should be aware of this capability, especially those in sectors like finance, defense, and critical infrastructure where firmware integrity is paramount.

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 30 Jun 2025, 00:39 UTC

Technical details

Community reviews

Related threats