CVE-2022-21894

CVE-2022-21894, also known as "Baton Drop," is a significant vulnerability in software design or implementation that affects Windows machines. It was identified and patched by Microsoft in January 2022. This flaw bypasses security features during the device's startup process, specifically the Secure Boot feature, allowing malicious actors to gain control of endpoints during the early phase of software boot. The malware BlackLotus exploits this vulnerability, even in fully patched Windows 11 systems. To disable Secure Boot, BlackLotus uses a bootkit to exploit the Baton Drop vulnerability and deploys an older, vulnerable Windows boot loader. Notably, BlackLotus can infect Windows machines with Secure Boot enabled, thus evading one of the key security measures in place on these systems. Despite the patch released by Microsoft, the continued exploitation of this vulnerability underscores the importance of not only applying patches promptly but also maintaining vigilance for potential new attack vectors. Organizations are advised to ensure their systems are up-to-date and to monitor for any signs of intrusion, particularly during the device's startup process where the Baton Drop vulnerability is most potent.