Skip to content
Fencer Vulns
high 8.2

CVE-2024-7344 json

Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.

published 2025-01-14 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-48259

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.

Patch / fix

  • Radix SmartRecovery 11.2.023-20240927
  • Greenware Technologies GreenGuard 10.2.023-20240927
  • Howyar Technologies SysReturn (32-bit and 64-bit) 10.2.02320240919
  • SANFONG SANFONG EZ-Back System 10.3.024-20241127
  • CES Taiwan CES NeoImpact 10.1.024-20241127
  • SignalComputer HDD King 10.3.021-20241127

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-7344 updated

howyar-sysreturn: Howyar UEFI Application "Reloader": Unsigned software execution via hardcoded path

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
13 mo ago

Exploit prediction

1.08% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • welivesecurity.com https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA 3.1 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Radix SmartRecovery
  • Greenware Technologies GreenGuard
  • Howyar Technologies SysReturn (32-bit and 64-bit)
  • SANFONG SANFONG EZ-Back System
  • CES Taiwan CES NeoImpact
  • SignalComputer HDD King

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.