CVE-2017-3197 is a critical vulnerability affecting specific GIGABYTE BRIX UEFI firmware versions (F6 for GB-BSi7H-6500 and F2 for GB-BXi7-5775). The flaw stems from insecure implementation of BIOS protection features, allowing arbitrary write access to the SPI flash and potential modification of the BIOS. With a CVSS score of 9.8 (CRITICAL), this network-exploitable vulnerability requires no user interaction and could lead to complete compromise of confidentiality, integrity, and availability. While no public exploit code is available and it's not listed on CISA's KEV, the vulnerability has garnered significant community discussion and media coverage, indicating awareness of its severe potential impact, including the possibility of UEFI ransomware.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
f6CPE matchmatch criteria | cpe:2.3:o:gigabyte:gb-bsi7h-6500_firmware:f6:*:*:*:*:*:*:* | ||
f2CPE matchmatch criteria | cpe:2.3:o:gigabyte:gb-bxi7-5775_firmware:f2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.