Threat actors could leverage a quartet of Gigabyte firmware issues to facilitate UEFI security mechanism deactivation and system hijacking, SecurityWeek reports.
All of the flaws, tracked as CVE-2025-7026, CVE-2025-7027, CVE-2025-7028, and CVE-2025-7029, were identified within the firmware's System Management Mode and could be exploited for privilege escalation, arbitrary content writing to System Management RAM, and backdoor deployment for system persistence, according to Carnegie Mellon University's CERT Coordination Center. "An attacker with local or remote administrative privileges may exploit these vulnerabilities to execute arbitrary code in System Management Mode (Ring -2), bypassing OS-level protections," said CERT/CC. Moreover, implants injected using the vulnerabilities could remain upon reinstallation of the operating system, noted Binarly, which discovered and reported the security defects. Organizations using vulnerable Gigabyte firmware implementations have been advised to promptly implement firmware updates released by Gigabyte, as well as follow update instructions available in the vendor's security site.
All of the flaws, tracked as CVE-2025-7026, CVE-2025-7027, CVE-2025-7028, and CVE-2025-7029, were identified within the firmware's System Management Mode and could be exploited for privilege escalation, arbitrary content writing to System Management RAM, and backdoor deployment for system persistence, according to Carnegie Mellon University's CERT Coordination Center. "An attacker with local or remote administrative privileges may exploit these vulnerabilities to execute arbitrary code in System Management Mode (Ring -2), bypassing OS-level protections," said CERT/CC. Moreover, implants injected using the vulnerabilities could remain upon reinstallation of the operating system, noted Binarly, which discovered and reported the security defects. Organizations using vulnerable Gigabyte firmware implementations have been advised to promptly implement firmware updates released by Gigabyte, as well as follow update instructions available in the vendor's security site.
