CVE-2017-3198
GIGABYTE BRIX UEFI firmware is not cryptographically signed
- State
- Published
- Severity
- Not scored
- Published
- Jul 9, 2018
- Updated
- Aug 5, 2024
- Reserved
- Dec 5, 2016
Description
GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served over HTTP. An attacker can make arbitrary modifications to firmware images without being detected.
Scores
The record has no CVSS score.
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
GB-BSi7H-6500GIGABYTE |
|
GB-BXi7-5775GIGABYTE |
|
References
- VU#507496third-party-advisory
- 97294vdb-entry
- https://www.cylance.com/en_us/blog/gigabyte-brix-systems-vulnerabilities.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.