CVEvulnerability
CVE-2017-3198
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-07-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-311, CWE-345, CWE-347
Description
GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served over HTTP. An attacker can make arbitrary modifications to firmware images without being detected.
Affected configurations
• gigabyte gb-bsi7h-6500 firmware f6
• gigabyte gb-bxi7-5775 firmware f2
Related
References
- http://www.securityfocus.com/bid/97294 Third Party Advisory, VDB Entry
- https://www.cylance.com/en_us/blog/gigabyte-brix-systems-vulnerabilities.html Exploit, Third Party Advisory
- https://www.kb.cert.org/vuls/id/507496 Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/97294 Third Party Advisory, VDB Entry
- https://www.cylance.com/en_us/blog/gigabyte-brix-systems-vulnerabilities.html Exploit, Third Party Advisory
- https://www.kb.cert.org/vuls/id/507496 Third Party Advisory, US Government Resource