Vulnerability CVE-2017-3198
Published: 2018-07-09

Description:
GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served over HTTP. An attacker can make arbitrary modifications to firmware images without being detected.

Type:

CWE-347

 (Improper Verification of Cryptographic Signature)

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Gigabyte -> Gb-bsi7h-6500 firmware 
Gigabyte -> Gb-bxi7-5775 firmware 

 References:
http://www.securityfocus.com/bid/97294
https://www.cylance.com/en_us/blog/gigabyte-brix-systems-vulnerabilities.html
https://www.kb.cert.org/vuls/id/507496
Copyright 2024, cxsecurity.com

 

Back to Top