Vulnerability record · CVE-2017-3198 · published 9 July 2018

CVE-2017-3198: Gigabyte gb-bsi7h-6500 firmware insufficient verification of data authenticity vulnerability

Gigabyte · Gb Bsi7h 6500 Firmware

GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served over HTTP. An attacker can make arbitrary modifications to firmware images without being detected.

9.8 CVSS 3.0 Critical EPSS 1.6% · top 25.5% CWE-345 · Insufficient verification of data authenticityCWE-311 · Missing encryption

9.8CVSS 3.0 base score, v2 10.0

1.6%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

6References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Gb Bsi7h 6500 Firmware Gigabyte

Gb Bxi7 5775 Firmware Gigabyte

References

Link	Tags
http://www.securityfocus.com/bid/97294	Third Party AdvisoryVDB Entry
https://www.cylance.com/en_us/blog/gigabyte-brix-systems-vulnerabilities.html	ExploitThird Party Advisory
https://www.kb.cert.org/vuls/id/507496	Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/97294	Third Party AdvisoryVDB Entry
https://www.cylance.com/en_us/blog/gigabyte-brix-systems-vulnerabilities.html	ExploitThird Party Advisory
https://www.kb.cert.org/vuls/id/507496	Third Party AdvisoryUS Government Resource

Track CVE-2017-3198 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2017-3197Gigabyte gb-bsi7h-6500 firmware improper input validation vulnerabilityGIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 (version F6) and GB-BXi7-5775 (version F2) platforms does not securely implement BIOSWE, BLE, SMM_B…EPSS 5.6%9 Jul 2018 7.8CVE-2023-38831WinRAR ZIP archive spoofing leads to arbitrary code executionWinRAR before 6.23 mishandles ZIP archives that contain a benign file and a folder with the same name, causing the folder's contents to be processed …KEVEPSS 100%analysed23 Aug 2023 9.8CVE-2022-26871Trend Micro Apex Central unauthenticated arbitrary file uploadTrend Micro Apex Central (and Apex One) contains an arbitrary file upload flaw caused by insufficient verification of data authenticity (CWE-345). An…KEVEPSS 19%analysed29 Mar 2022

Source: NIST National Vulnerability Database (record CVE-2017-3198), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.