CVE-2024-28920: 
vulnerability analysis and mitigation

A security feature bypass vulnerability exists in Microsoft Windows Secure Boot. The vulnerability, tracked as CVE-2024-28920, was disclosed on April 9, 2024, as part of Microsoft's April 2024 Patch Tuesday release. The vulnerability affects multiple versions of Microsoft Windows and has been assigned a CVSSv3 score of 7.8 (Microsoft Advisory).

CVE-2024-28920 is a security feature bypass vulnerability in Windows Secure Boot that received a CVSSv3 score of 7.8. The vulnerability requires an attacker to have either physical access or local administrator privileges on the vulnerable device to exploit. This vulnerability was one of 24 Secure Boot-related vulnerabilities patched in the April 2024 update (Tenable Blog).

Successful exploitation of this vulnerability could allow an attacker to bypass Windows Secure Boot security features, potentially compromising the secure boot process of affected systems (Microsoft Advisory).

Microsoft has rated this vulnerability as 'Exploitation Less Likely' according to their Exploitability Index. The vulnerability requires local access or administrative privileges to exploit, which reduces the likelihood of widespread exploitation (Tenable Blog).

Microsoft has released security updates to address this vulnerability as part of their April 2024 Patch Tuesday release. Organizations are advised to apply the available patches to affected systems (Microsoft Advisory).