CVE-2017-3198

GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served over HTTP. An attacker can make arbitrary modifications to firmware images without being detected.

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

1.60% chance of exploitation in the next 30 days, 74th percentile

Published

2018-07-09

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://www.cylance.com/en_us/blog/gigabyte-brix-systems-vulnerabilities.html

References

• CVE Record
• NVD entry

Related

• CVE-2017-3197
• CVE-2017-3199
• CVE-2017-3196
• CVE-2017-3200
• CVE-2017-3195
• CVE-2017-3201