CVE-2017-3198 impacts GIGABYTE BRIX UEFI firmware, specifically models like the GB-BSI7H-6500 and GB-BXI7-5775. The vulnerability stems from the firmware's failure to cryptographically validate updates, which are also delivered insecurely over HTTP, allowing an attacker to arbitrarily modify firmware images. This critical vulnerability (CVSS 9.8) is easily exploitable remotely with no user interaction, enabling full compromise of confidentiality, integrity, and availability. While not currently in the KEV catalog or having public exploit code, it has garnered significant community discussion and media coverage, indicating awareness of its severe potential.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
f6CPE matchmatch criteria | cpe:2.3:o:gigabyte:gb-bsi7h-6500_firmware:f6:*:*:*:*:*:*:* | ||
f2CPE matchmatch criteria | cpe:2.3:o:gigabyte:gb-bxi7-5775_firmware:f2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.