GCVE-110-CERTCC-2017-507496

Advisory PublishedCVSS 6.0/10

Vulnetix · Advisory published March 31, 2017

GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 and GB-BXi7-5775 platforms, versions vF6 and vF2 respectively, fails to properly set the BIOSWE, BLE, SMM_BWP, and PRx bits to enforce write protection. It also is not cryptographically signed. These issues may permit an attacker to write arbitrary code to the platform firmware, potentially allowing for persistent firmware level rootkits or the creation of a permanent denial of service condition in the platform.

Download JSON Open in Console

Risk Scores

CVSS 2.0

6.0/10

Medium · AV:L/AC:H/Au:S/C:C/I:C/A:C

certcc-cam

impact0population0exploitation0widely_known0score_current0ease_of_exploitation0

certcc-vrda

d1_impact3d1_population2d1_direct_report1

certcc-cvss-temporal-env

temporal_score5.1remediation_levelNDreport_confidenceURenvironmental_score7.08844845568target_distributionNDenvironmental_vectorCDP:MH/TD:ND/CR:ND/IR:H/AR:ND