Embedded malicious code (backdoor) in GIGABYTE Global products - #VU76737

Vulnerability identifier: #VU76737

CSH Severity: Critical

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red

CVE-ID: N/A

CWE-ID: CWE-506

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vulnerable software:
A520M S2H rev 1.x
A620M GAMING X AX rev 1.0
A620M GAMING X rev 1.0
B360M DS3H rev 1.0
B365 HD3 rev 1.0
B365M DS3H rev 1.0
B450 AORUS Elite V2 rev 1.x
B450 AORUS M rev 1.x
B450 Gaming X rev 1.x
B450M AORUS ELITE rev 1.x
B450M DS3H rev 1.x
B450M DS3H V2 rev 1.x
B450M DS3H WIFI rev 1.x
B450M GAMING rev 1.x
B450M H rev 1.x
B450M K rev 1.0
B450M S2H rev 1.x
B460 AORUS PRO AC rev 1.0
B460 HD3 rev 1.0
B460M AORUS PRO rev 1.0
B460M D2V rev 1.0
B460M D3H rev 1.0
B460M DS3H AC rev 1.x
B460M DS3H rev 1.0
B460M GAMING HD rev 1.0
B460M POWER rev 1.0
B550 AORUS ELITE AX rev 1.0
B550 AORUS ELITE AX V2 rev 1.2
B550 AORUS ELITE AX V2 rev 1.2/1.3
B550 AORUS ELITE rev 1.0
B550 AORUS ELITE V2 rev 1.2
B550 GAMING X V2 rev 1.0/1.1/1.2
B550 GAMING X V2 rev 1.3
B550 GAMING X V2 rev 1.4
B550 Gaming X V2 rev 1.x
B550 UD AC rev 1.0 11
B550 UD AC rev 1.2
B550I AORUS PRO AX rev 1.0
B550I AORUS PRO AX rev 1.1
B550I AORUS PRO AX rev 1.2
B550M AORUS ELITE AX rev 1.3
B550M AORUS ELITE rev 1.0/1.1/1.2
B550M AORUS ELITE rev 1.3
B550M AORUS ELITE rev 1.x
B550M AORUS PRO AX rev 1.0
B550M AORUS PRO AX rev 1.1
B550M AORUS PRO P rev 1.0
B550M AORUS PRO P rev 1.1
B550M AORUS PRO P rev 1.2
B550M AORUS PRO rev 1.0
B550M DS3H AC rev 1.0/1.1/1.2/1.3
B550M DS3H AC rev 1.0/1.1/1.2/1.3/1.4
B550M DS3H AC rev 1.4
B550M DS3H AC rev 1.5 1.6
B550M DS3H AC rev 1.x
B550M DS3H rev 1.0/1.1/1.2/1.3
B550M DS3H rev 1.4
B550M DS3H rev 1.5
B550M DS3H rev 1.x
B550M GAMING rev 1.x
B550M K rev 1.0
B550M S2H rev 1.x
B560 AORUS PRO AX rev 1.0
B560 HD3 rev 1.x
B560I AORUS PRO AX rev 1.0
B560M AORUS ELITE rev 1.x
B560M AORUS PRO AX rev 1.x
B560M AORUS PRO rev 1.x
B560M D2V rev 1.x
B560M D3H rev 1.x
B560M DS3H AC rev 1.x
B560M DS3H PLUS rev 1.0
B560M DS3H V2 rev 1.0
B560M GAMING HD rev 1.x
B560M H rev 1.x
B560M H V2 rev 1.0
B560M POWER rev 1.x
B650 AERO G rev 1.0
B650 AORUS ELITE AX rev 1.x
B650 AORUS ELITE rev 1.0
B650 AORUS PRO AX rev 1.x
B650 GAMING X AX rev 1.0/1.1
B650 GAMING X AX rev 1.x
B650 GAMING X rev 1.0
B650 GAMING X rev 1.0 11
B650E AORUS MASTER rev 1.0
B650E AORUS TACHYON rev 1.0
B650I AORUS ULTRA rev 1.0
B650M AORUS ELITE AX rev 1.x
B650M AORUS ELITE rev 1.0
B650M AORUS PRO AX rev 1.x
B650M C rev 1.0
B650M DS3H rev 1.0
B650M GAMING X AX rev 1.x
B650M K rev 1.0
B660 AORUS ELITE AX DDR4 rev 1.0
B660 AORUS ELITE DDR4 rev 1.0
B660 AORUS MASTER DDR4 rev 1.0
B660 AORUS MASTER DDR4 rev 1.x
B660 AORUS MASTER rev 1.x
B660 DS3H AC DDR4 rev 1.0
B660 DS3H AC DDR4 rev 1.0/1.2
B660 DS3H AC DDR4 rev 1.1
B660 DS3H AC rev 1.0
B660 DS3H AX DDR4 rev 1.0
B660 DS3H AX DDR4 rev 1.0/1.1
B660 DS3H DDR4 rev 1.0
B660 DS3H DDR4 rev 1.0/1.1
B660 GAMING X AX DDR4 rev 1.0
B660 GAMING X DDR4 rev 1.0
B660 GAMING X rev 1.0
B660I AORUS PRO DDR4 rev 1.x
B660M AORUS ELITE AX DDR4 rev 1.0
B660M AORUS ELITE AX DDR4 rev 1.x
B660M AORUS ELITE DDR4 rev 1.0
B660M AORUS ELITE DDR4 rev 1.x
B660M AORUS PRO AX DDR4 rev 1.x
B660M AORUS PRO AX rev 1.x
B660M AORUS PRO DDR4 rev 1.0
B660M AORUS PRO rev 1.0
B660M D2H DDR4 rev 1.0
B660M D3H DDR4 rev 1.0
B660M DS3H AX DDR4 rev 1.x
B660M DS3H DDR4 rev 1.0
B660M GAMING AC DDR4 rev 1.0
B660M GAMING AC DDR4 rev 1.x
B660M GAMING AC rev 1.0
B660M GAMING DDR4 rev 1.0
B660M GAMING X AX DDR4 rev 1.x
B660M GAMING X AX rev 1.0
B660M GAMING X DDR4 rev 1.0
B660M GAMING X DDR4 rev 1.x
B660M GAMING X rev 1.0
B660M POWER DDR4 rev 1.0
B760M POWER rev 1.0
GA B560M D3P rev 1.0
H510M K rev 1.0
H510M K rev 1.1
H510M S2 rev 1.0/1.1/1.2
H510M S2 rev 1.3
H510M S2H rev 1.0
H510M S2H V2 rev 1.0
H510M S2H V2 rev 1.1
H510M S2H V2 rev 1.3
H510M S2P rev 1.0
H510M S2P rev 1.0 12
H610I DDR4 rev 1.0
H610M H DDR4 rev 1.0
H610M H DDR4 rev 1.1
H610M H DDR4 rev 1.1/1.3
H610M H DDR4 rev 1.2
H610M H rev 1.0
H610M H V2 DDR4 rev 1.0
H610M HD3P rev 1.0
H610M HD3P rev 20
H610M K DDR4 rev 1.0
H610M S2 DDR4 rev 1.0
H610M S2 DDR4 rev 1.1
H610M S2 DDR4 rev 1.1/1.3
H610M S2 DDR4 rev 1.2
H610M S2 rev 1.0
H610M S2 V2 DDR4 rev 1.0
H610M S2H DDR4 rev 1.0
H610M S2H DDR4 rev 1.1
H610M S2H DDR4 rev 1.1/1.3
H610M S2H DDR4 rev 1.2
H610M S2H rev 1.0
H610M S2H V2 DDR4 rev 1.0
N4120I H rev 1.0
N5105I H rev 1.0
Q670M D3H DDR4 rev 1.0
W480M VISION W rev 1.0
X570S AORUS ELITE AX rev 1.1
X570S AORUS ELITE rev 1.0
X570S AORUS MASTER rev 1.0
X570S AORUS PRO AX rev 1.0
X570S AORUS PRO AX rev 1.1
X570S GAMING X rev 1.0
X570S UD rev 1.0
X570SI AORUS PRO AX rev 1.0
X570SI AORUS PRO AX rev 1.1
X670 AORUS ELITE AX rev 1.0
X670 AORUS ELITE AX rev 1.1
X670 GAMING X AX rev 1.0
X670E AORUS MASTER rev 1.0
X670E AORUS XTREME rev 1.0
Z590 AORUS ELITE AX rev 1.0
Z590 AORUS ELITE rev 1.0
Z590 AORUS MASTER rev 1.0
Z590 AORUS PRO AX rev 1.0
Z590 AORUS TACHYON rev 1.0
Z590 AORUS ULTRA rev 1.0
Z590 D rev 1.0
Z590 GAMING X rev 1.x
Z590 UD AC rev 1.x
Z590 UD rev 1.0
Z590I AORUS ULTRA rev 1.0
Z690 AERO D rev 1.0
Z690 AERO D rev 1.x
Z690 AERO G DDR4 rev 1.0
Z690 AERO G DDR4 rev 1.x
Z690 AERO G rev 1.0
Z690 AERO G rev 1.x
Z690 AORUS ELITE AX DDR4 rev 1.0
Z690 AORUS ELITE AX DDR4 rev 1.x
Z690 AORUS ELITE AX DDR4 V2 rev 1.0
Z690 AORUS ELITE AX rev 1.0
Z690 AORUS ELITE AX rev 1.4
Z690 AORUS ELITE AX rev 1.x
Z690 AORUS ELITE DDR4 rev 1.0
Z690 AORUS ELITE DDR4 rev 1.x
Z690 AORUS ELITE DDR4 V2 rev 1.0
Z690 AORUS ELITE rev 1.0
Z690 AORUS ELITE STEALTH rev 1.0
Z690 AORUS MASTER rev 1.0
Z690 AORUS MASTER rev 1.x
Z690 AORUS PRO DDR4 rev 1.0
Z690 AORUS PRO DDR4 rev 1.x
Z690 AORUS PRO rev 1.0
Z690 AORUS PRO rev 1.x
Z690 AORUS TACHYON rev 1.0
Z690 AORUS ULTRA rev 1.0
Z690 AORUS ULTRA rev 1.x
Z690 AORUS XTREME rev 1.0
Z690 AORUS XTREME WATERFORCE rev 1.0
Z690 GAMING X DDR4 rev 1.0
Z690 GAMING X DDR4 rev 1.1
Z690 GAMING X DDR4 V2 rev 1.0
Z690 GAMING X rev 1.0
Z690 GAMING X rev 1.0/1.1
Z690 UD AC rev 1.0
Z690 UD AX DDR4 rev 1.0
Z690 UD AX DDR4 rev 1.x
Z690 UD AX DDR4 V2 rev 1.0
Z690 UD AX rev 1.0
Z690 UD AX rev 1.x
Z690 UD DDR4 rev 1.0
Z690 UD DDR4 rev 1.x
Z690 UD DDR4 V2 rev 1.0
Z690 UD rev 1.0
Z690 UD rev 1.x
Z690I AORUS ULTRA DDR4 rev 1.0
Z690I AORUS ULTRA LITE DDR4 rev 1.0
Z690I AORUS ULTRA LITE rev 1.0
Z690I AORUS ULTRA PLUS DDR4 rev 1.0
Z690I AORUS ULTRA PLUS rev 1.0
Z690I AORUS ULTRA rev 1.0
Z690M AORUS ELITE AX DDR4 rev 1.0
Z690M AORUS ELITE AX DDR4 rev 1.x
Z690M AORUS ELITE DDR4 rev 1.0
Z690M DS3H DDR4 rev 1.0
Z790 AERO G rev 1.0
Z790 AORUS ELITE AX DDR4 rev 1.0
Z790 AORUS ELITE AX rev 1.0
Z790 AORUS ELITE AX rev 1.1
Z790 AORUS ELITE DDR4 rev 1.0
Z790 AORUS ELITE rev 1.0
Z790 AORUS ELITE rev 1.1
Z790 AORUS MASTER rev 1.0
Z790 AORUS TACHYON rev 1.0
Z790 AORUS XTREME rev 1.0
Z790 D DDR4 rev 1.0
Z790 GAMING X AX rev 1.0
Z790 GAMING X AX rev 1.x
Z790 GAMING X rev 1.0
Z790 UD AC rev 1.0
Z790 UD AX rev 1.0
Z790 UD rev 1.0
Z790I AORUS ULTRA rev 1.0
Z790M AORUS ELITE AX rev 1.0
Z790M AORUS ELITE rev 1.0
UEFI firmware

Software vendor:
GIGABYTE Global

The vulnerability allows a remote attacker to gain unauthorized access to the system.

The vulnerability exists due to presence of embedded malicious functionality (aka backdoor) in the UEFI firmware that was downloaded from the official website using the Gigabyte's App Center. This allows a remote attacker to gain full control over the system.

Note, the vulnerability is being actively exploited in the wild.

Install update from vendor's website.

• https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/
• https://www.gigabyte.com/Press/News/2091