Framework Laptop 12 Intel® Core™ 13th Gen BIOS 3.07 Release STABLE

[Quin_Chou]

Highlights

1. Update Microcode to 0x6133.
2. Update Intel SIC to 0C.01.F6.20.
3. Modified the F2 key in the F12 Boot Menu to go to the setup menu instead of the settings menu to allow easier navigation to secure boot settings.
4. Enhanced the Power On AC behavior, allowing the feature to work correctly without requiring the system to boot into the Operating System at least once for initialization.
5. Fixed CPU Fan Not Present Error when “Boot Performance Mode” = “Max Battery” in BIOS.
6. Security Fixes - CVE-2025-20064, CVE-2025-20037.

You can check your current BIOS version following the steps here to determine if you are on the latest release.

Subscribing to release notifications

If you want to subscribe to new release notifications you can now opt in through this link to receive an email when we release a new BIOS or driver update for your Framework Laptop.

Downloads

Windows

Download Link	SHA256
Framework_Laptop_12_13th_Gen_Intel_Core_BIOS_3.07.exe	819121DD2FDFF32764ADC9B0E62E5563FAF462E27B0502CAA7BD52F8CDE73A55

Instructions for Windows Installer:

1. Run the .exe.
2. Click yes to reboot.
3. Wait for the firmware progress bar to complete, and then the system will reboot.

Please note that you must update with a charger attached.

Linux/LVFS

Please note that you must update with a charger attached, then run:

fwupdmgr refresh --force

then

fwupdmgr get-updates

then

fwupdmgr update

Please note that you must update with a charger attached.

LVFS may not update if the battery is 100% charged. LVFS uses the battery status to determine if it is safe to apply updates. However if our battery is at 100% and the charger is off, we set the battery charging status to false. In this case you can discharge your battery a few percent, then plug in AC again and run fwupdmgr update.

Linux/Other/UEFI Shell update

Download Link	SHA256
Framework_Laptop_12_13th_Gen_Intel_Core_BIOS_3.07_EFI.zip	4E02D4AD12BAC8EB7CAB462BF781D123FD1524FA702C134DBC68997F61D5AA2F

Note that if you use the EFI shell update with Windows, you should suspend Bitlocker if enabled before updating using the EFI updater.

Instructions for EFI shell update:

1. Extract contents of zip folder to a FAT32 formatted USB drive. Cleanly unmount the drive before physically removing it, otherwise the BIOS update may not function correctly.
2. Attach a charger to your device while updating.
3. Boot your system while pressing F12 and boot from the thumb drive.
4. Let startup.nsh run automatically.
5. Follow the instructions to install the update.

Security Fixes

Module Name	Vulnerability	Score
CVE-2025-20064	Improper input validation in the UEFI FlashUcAcmSmm module for some Intel(R) reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.	8.7
CVE-2025-20037	Time-of-check time-of-use race condition in firmware for some Intel(R) Converged Security and Management Engine may allow a privileged user to potentially enable escalation of privilege via local access.	7.2

Enhancements

1. Update Microcode to 0x6133.
2. Update Intel SIC to 0C.01.F6.20.
3. Modified the F2 key in the F12 Boot Menu to go to the setup menu instead of the settings menu to allow easier navigation to secure boot settings.
4. Enhanced the Power On AC behavior, allowing the feature to work correctly without requiring the system to boot into the Operating System at least once for initialization.

Fixes

1. Fixed CPU Fan Not Present Error when “Boot Performance Mode” = “Max Battery” in BIOS.
2. Security Fixes - CVE-2025-20064, CVE-2025-20037.

Component Versions

This BIOS update is a bundle of updates to multiple embedded components in the system.

Not all of them use the same version number.

Firmware	Version	Update?
BIOS	3.07	Updated
Intel SIC	0C.01.F6.20	Updated
Intel CSME	16.1.32.2473v3	Same
MCU	0x6133	Updated
GOP	21.0.1066	Same
EC	ec_307_fc818ef	Updated
PD	0.0.12	Same

Reporting Issues

To report issues we have created a public issue tracker on github. Issues · FrameworkComputer/SoftwareFirmwareIssueTracker · GitHub

We hope that this is a better way to track issues with community involvement moving forward as we have found it difficult to both gather relevant information about issues people are reporting on the forums, and track the issues through their lifecycle in a transparent way.

If you do experience an issue with the update that is related to your system firmware, please post as complete a description as you can, including relevant system information, and external peripherals. Please note that we do not currently have a SLA for responding to issues on github, but we will be reviewing them through the bios release process, and will review them for future updates as well.

If you have an issue regarding hardware, broken devices, returns, etc, this is not the place, please contact Framework Support. https://frame.work/support

Known Issues

None

[Aurom]

Framework Laptop 12 BIOS 3.07 beta fixes CPU fan error, updates microcode (0x6133) and Intel SIC (0C.01.F6.20), improves Power On AC behavior, and adds security fixes CVE-2025-20064 & CVE-2025-20037.

Update via Windows .exe, Linux LVFS testing channel, or EFI shell with charger connected. Suspend Bitlocker if using EFI updater. No major known issues.

[goodusernamesaregone]

@Quin_Chou

A vulnerability, which was classified as critical, has been found in projectworlds Life Insurance Management System 1.0. Affected by this issue is some unknown functionality of the file /deletePayment.php. The manipulation of the argument recipt_no leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

I think this is not the block of text you meant to paste here.

[Quin_Chou]

It is this vulnerability description.

[jayasafunctionofe]

The quote about the PHP issue in the Life Insurance Management System 1.0 is CVE-2025-2064, not 20064. When I google “CVE-2025-20064” the wrong CVE (2064, the one you cited) is the first to come up. Did you perhaps click on the wrong link when looking for the CVE description?

According to NIST CVE-2025-20064 doesn’t yet exist (or is reserved)

NVD - CVE-2025-20064

[bbigras]

Anyone else has this error while updating (I’m on nixos):

╔══════════════════════════════════════════════════════════════════════════════╗
║ Upgrade System Firmware from 0.0.3.6 to 0.0.3.7?                             ║
╠══════════════════════════════════════════════════════════════════════════════╣
║ Enhanced and Fixed:                                                          ║
║                                                                              ║
║ • Update Microcode to 0x6133.                                                ║
║ • Update Intel SIC to 0C.01.F6.20.                                           ║
║ • Modified the F2 key in the F12 Boot Menu to go to the setup menu           ║
║ instead of the settings menu to allow easier navigation to secure boot       ║
║ settings.                                                                    ║
║ • Enhanced the Power On AC behavior, allowing the feature to work            ║
║ correctly without requiring the system to boot into the Operating System at  ║
║ least once for initialization.                                               ║
║ • Fixed CPU Fan Not Present Error when "Boot Performance Mode" = "Max        ║
║ Battery" in BIOS.                                                            ║
║                                                                              ║
║ Laptop 12 (13th Gen Intel Core) must remain plugged into a power source for  ║
║ the duration of the update to avoid damage.                                  ║
╚══════════════════════════════════════════════════════════════════════════════╝
Effectuer l'opération ? [Y|n]:
Planification…           [                                       ]  ]
failed to write-firmware: Erreur lors de l’ouverture du fichier /sys/firmware/efi/efivars/BootOrder-8be4df61-93ca-11d2-aa0d-00e098032b8c : No such file or directory

[pierce]

The details of CVE-2025-60024 were published on March 10th or so.

Improper input validation in the UEFI FlashUcAcmSmm module for some Intel(R) reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable local code execution.

The “Smm” part refers to “system management mode”, which is a way for firmware/bios to run code via special interrupts in a way that the operating system kernel can’t block or even really observe (this has existed for many years and OS developers have never been fond of it). But an OS driver can trigger them with an SMI, “system management interrupt”, and apparently this vulnerability is with one SMI in particular. Some blog post I found explains:

By reverse engineering the FlashUcAcmSmm module, it’s possible to discover a handler that serves user-supplied structures via an SMI (System Management Interrupt) interface. The handler expects a structure in shared memory, but neglects to validate input length or pointer boundaries.

(So if an attacker already has execution at the root/admin/kernel level, this vuln can theoretically offer execution/modification at the SMM level, which is even above the that.)

[Jamie_Gaehring]

Cross-posting from Secureboot setup mode, but this update seems to break some requirements for secure boot, unless there are already existing workarounds I haven’t been able uncover yet.

[goodusernamesaregone]

@bbigras

Anyone else has this error while updating (I’m on nixos):

Set a boot order using efibootmgr (which will create the missing file) and then try again.

[bbigras]

Thank you very much. I think sudo efibootmgr -c -d /dev/nvme0n1 -p 1 -L “Linux Boot Manager” -l ‘\EFI\systemd\systemd-bootx64.efi didn’t work, but sudo bootctl install --esp-path=/boot did.