vulnwire
9.8crit

CVE-2017-3198

GIGABYTE BRIX UEFI firmware is not cryptographically signed

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.6%
percentile 76%
Public exploits
0
none known

GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served over HTTP. An attacker can make arbitrary modifications to firmware images without being detected.

Exploit prediction (EPSS)

1.58% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • GIGABYTE GB-BSi7H-6500
  • GIGABYTE GB-BXi7-5775

Classification

Weakness
  • CWE-345 Insufficient Verification of Data Authenticity
  • CWE-311 Missing Encryption of Sensitive Data
  • CWE-347 Improper Verification of Cryptographic Signature

References

  • kb.cert.org /vuls/id/507496 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • securityfocus.com /bid/97294 · vdb-entry, x_refsource_BID, x_transferred
  • cylance.com /en_us/blog/gigabyte-brix-systems-vulnerabilities.html · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.