CVE-2017-3197

GIGABYTE BRIX UEFI firmware fails to securely implement BIOS write protection

No known exploitation. EPSS puts it in the 93rd percentile. No fix published yet.

CVSS 3.09.8Critical EPSS percentile93rd5.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2018-07-09Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you run one of these exact models/firmware: gb-bsi7h-6500 firmware F6 or gb-bxi7-5775 firmware F2.
If you match, assume attackers who can reach the device can make persistent firmware changes.
Contact GIGABYTE (or your VAR/IT vendor) and ask for the official update or mitigation for CVE-2017-3197 for your exact model and firmware version.
Restrict network access to the affected device so it is not reachable from the internet (only allow required internal connections; block inbound traffic at the firewall).
If you cannot update quickly, isolate the device on a tightly controlled network and ensure no exposed remote-management ports are reachable from outside your office network.
Document the current firmware state and re-check periodically for vendor releases because no fix is available in the information provided here.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 (version F6) and GB-BXi7-5775 (version F2) platforms does not securely implement BIOSWE, BLE, SMM_BWP, and PRx features. As a result, the BIOS is not protected from arbitrary write access and may permit modifications to the SPI flash.

In plain language

Written by AI from the record

This GIGABYTE BRIX UEFI firmware flaw lets an attacker change core BIOS settings over the network, even without login or clicks, so a typical small business should treat it as a serious risk if the device can be reached from the internet.

CVE-2017-3197 is an unauthenticated network vulnerability in affected GIGABYTE BRIX UEFI firmware where missing or improperly implemented BIOS write-protection/security-lock features allow an attacker to gain unlimited control over core device configuration and permanently alter underlying firmware.

If you're affected

Firmware tampering
Persistent system compromise
Full device takeover
Operations disruption

What is it

UEFI firmware is the “boot-time instruction set” your device uses before the operating system loads—like the rules the hardware follows to start up safely. This vulnerability means the device’s built-in protections meant to stop outsiders from changing those rules over the network aren’t properly enforced.

The danger is persistence: once firmware is changed, the attacker can keep control even after reboots, similar to quietly swapping the device’s start-up manual.

Who is affected

This matters if your business uses GIGABYTE BRIX devices with the affected firmware versions: gb-bsi7h-6500 firmware F6 and/or gb-bxi7-5775 firmware F2.

It’s a network risk with no login and no user interaction required, and it is reachable in the default configuration. The exposure is mainly driven by whether someone can reach the device over the network (for example, from the internet or other reachable networks).

How urgent is it

Treat this as urgent enough to act now because it allows attackers who can reach the device over the network to permanently change core firmware protections, without needing a login or user clicks. The information available here does not include a confirmed fixed version, so you need to focus on containment (blocking access) and vendor confirmation.

What to do — in detail

Confirm whether you’re affected

Identify whether you run one of these exact products:
- gb-bsi7h-6500
- gb-bxi7-5775
Check the UEFI/BIOS firmware version currently installed.
- This is expected to be vulnerable when it matches:
  - gb-bsi7h-6500 firmware F6
  - gb-bxi7-5775 firmware F2

Determine the fastest mitigation path

If you match the vulnerable firmware versions, there is no confirmed patch/fixed version in the information provided here. Contact GIGABYTE (or your VAR) specifically for CVE-2017-3197 and your model+firmware version.
Immediately reduce exposure:
- Ensure the device is not reachable from the internet.
- Block inbound connections to the device at your firewall/router.
- If you have remote-management features enabled, ensure they are not exposed outside your office network.

Compensating controls (if patching is delayed)

Isolate the device on a tightly controlled network segment.
Monitor for abnormal network traffic to the device (especially unexpected inbound connections from outside expected management networks).
Keep a record of:
- device model
- firmware version
- dates you changed network rules

When a fix becomes available

Once vendor guidance is received, compare it to your current firmware and upgrade to the stated fixed version.
After upgrading, re-verify the firmware version and confirm the device still operates normally.

Technical context

Severity is effectively high because the weakness allows unlimited control over core device configuration and the ability to permanently alter underlying firmware programming. The attack vector is network-based with no authentication and no user interaction required, and it is described as reachable in default configuration.

The underlying issue is that GIGABYTE BRIX UEFI firmware does not securely implement BIOS write protection/security lock mechanisms (including BIOSWE/BLE/SMM_BWP/PRx-related protections as described in the backstop), which can permit arbitrary write access to the SPI flash and related firmware modifications.

CISA KEV listing was not provided for this CVE in the findings. No public exploit code is listed in the findings, but press attention is rising. A patch/fixed version is not available in the provided patch information, so remediation guidance depends on vendor confirmation plus network containment.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS93rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

5.6% chance of exploitation activity in the next 30 days, which ranks it in the 93rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

unknown.

Real risk signals with little public attention so far.

Lifecycle

21 events over 2998 days, from the signal feeds we watch.

2026-09-23EPSS band changemoderate → lowepss band change
2026-09-21EPSS band changelow → moderateepss band change
2026-09-06EPSS band changemoderate → 0epss band change
2026-09-05EPSS band change0 → moderateepss band change
2026-08-31EPSS band changemoderate → 0epss band change
2026-08-29EPSS band changelow → moderate

Affected products

GIGABYTEcommercial · TWaka oc guru ii, aorus graphics engine, app center

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable