https://www.bleepingcomputer.com/news/security/gigabyte-motherboards-vulnerable-to-uefi-malware-bypassing-secure-boot/ BleepingComputer.com logo * * * * [ ] [Login] [Sign up] * * * * [ ] [Login] [Sign up] * News + Featured + Latest + NVIDIA shares guidance to defend GDDR6 GPUs against Rowhammer attacks NVIDIA shares guidance to defend GDDR6 GPUs against Rowhammer attacks + Google Gemini flaw hijacks email summaries for phishing Google Gemini flaw hijacks email summaries for phishing + '123456' password exposed chats for 64 million McDonald's job chatbot applications '123456' password exposed chats for 64 million McDonald's job chatbot applications + Exploits for pre-auth Fortinet FortiWeb RCE flaw released, patch now Exploits for pre-auth Fortinet FortiWeb RCE flaw released, patch now + UK launches vulnerability research program for external experts UK launches vulnerability research program for external experts + Interlock ransomware adopts FileFix method to deliver malware Interlock ransomware adopts FileFix method to deliver malware + Gigabyte motherboards vulnerable to UEFI malware bypassing Secure Boot Gigabyte motherboards vulnerable to UEFI malware bypassing Secure Boot + Malicious VSCode extension in Cursor IDE led to $500K crypto theft Malicious VSCode extension in Cursor IDE led to $500K crypto theft * Tutorials + Latest + Popular + How to access the Dark Web using the Tor Browser How to access the Dark Web using the Tor Browser + How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 + How to use the Windows Registry Editor How to use the Windows Registry Editor + How to backup and restore the Windows Registry How to backup and restore the Windows Registry + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Virus Removal Guides + Latest + Most Viewed + Ransomware + Remove the Theonlinesearch.com Search Redirect Remove the Theonlinesearch.com Search Redirect + Remove the Smartwebfinder.com Search Redirect Remove the Smartwebfinder.com Search Redirect + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * VPNs + Popular + Best VPNs Best VPNs + How to change IP address How to change IP address + Access the dark web safely Access the dark web safely + Best VPN for YouTube Best VPN for YouTube * Forums * More + Startup Database + Uninstall Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide push * Home * News * Security * Gigabyte motherboards vulnerable to UEFI malware bypassing Secure Boot * * Gigabyte motherboards vulnerable to UEFI malware bypassing Secure Boot By Bill Toulas * July 14, 2025 * 12:30 PM * 3 Gigabyte motherboards vulnerable to UEFI malware bypassing Secure Boot Dozens of Gigabyte motherboard models run on UEFI firmware vulnerable to security issues that allow planting bootkit malware that is invisible to the operating system and can survive reinstalls. The vulnerabilities could allow attackers with local or remote admin permissions to execute arbitrary code in System Management Mode (SMM), an environment isolated from the operating system (OS) and with more privileges on the machine. Mechanisms running code below the OS have low-level hardware access and initiate at boot time. Because of this, malware in these environments can bypass traditional security defenses on the system. UEFI, or Unified Extensible Firmware Interface, firmware is more secure due to the Secure Boot feature that ensures through cryptographic verifications that a device uses at boot time code that is safe and trusted. For this reason, UEFI-level malware like bootkits (BlackLotus, CosmicStrand, MosaicAggressor, MoonBounce, LoJax) can deploy malicious code at every boot. Plenty of motherboards impacted The four vulnerabilities are in Gigabyte firmware implementations and were discovered by researchers at firmware security company Binarly, who shared their findings with Carnegie Mellon University's CERT Coordination Center (CERT/CC). The original firmware supplier is American Megatrends Inc. (AMI), which addressed the issues after a private disclosure but some OEM firmware builds (e.g. Gigabyte's) did not implement the fixes at the time. In Gigabyte firmware implementations, Binarly found the following vulnerabilities, all with a high-severity score of 8.2: * CVE-2025-7029: bug in an SMI handler (OverClockSmiHandler) that can lead to SMM privilege escalation * CVE-2025-7028: bug in an SMI handler (SmiFlash) gives read/write access to the System Management RAM (SMRAM), which can lead to malware installation * CVE-2025-7027: can lead to SMM privilege escalation and modifying the firmware by writing arbitrary content to SMRAM * CVE-2025-7026: allows arbitrary writes to SMRAM and can lead to privilege escalation to SMM and persistent firmware compromise By our count, there are a little more than 240 motherboard models impacted - including revisions, variants, and region-specific editions, with firmware updated between late 2023 and mid-August 2024. BleepingComputer reached out to Binarly for an official count and a company representative told us that "over a hundred product lines are affected." Products from other enterprise device vendors are also impacted by the four vulnerabilities but their names remain undisclosed until fixes become available. Binarly researchers notified Carnegie Mellon CERT/CC about the issues on April 15 and Gigabyte confirmed the vulnerabilities on June 12, followed by the release of firmware updates, according to CERT/CC. However, the OEM has not published a security bulletin about the security problems that Binarly reported. BleepingComputer has emailed the hardware vendor a request for comment but we are still waiting for their response. Meanwhile, Binarly founder and CEO Alex Matrosov told BleepingComputer that Gigabyte most likely hasn't released fixes. With many of the products already having reached end-of-life, users should not expect to receive any security updates. "Because all these four vulnerabilities originated from AMI reference code, AMI disclosed these vulnerabilities a while ago with their silent disclosure to paid customers only under NDA, and it caused significant effects for years on the downstream vendors when they stayed vulnerable and unpatched" - Alex Matrosov "It seems that Gigabyte has not released any fixes yet, and many of the affected devices have reached end-of-life status, meaning they will likely remain vulnerable indefinitely." While the risk for general consumers is admittedly low, those in critical environments can assess the specific risk with Binarly's Risk Hunt scanner tool, which includes free detection for the four vulnerabilities. Computers from various OEMs using Gigabyte motherboards may be vulnerable, so users are advised to monitor for firmware updates and apply them promptly. UPDATE [July 14th, 13:23 EST]: Article updated with comment from Binarly saying that the four vulnerabilities affect more than 100 motherboards, and that products from other vendors are impacted. Tines Needle 8 Common Threats in 2025 While cloud attacks may be growing more sophisticated, attackers still succeed with surprisingly simple techniques. Drawing from Wiz's detections across thousands of organizations, this report reveals 8 key techniques used by cloud-fluent threat actors. Get the Report Related Articles: Hackers exploit OttoKit WordPress plugin flaw to add admin accounts Windows 10 KB5062554 cumulative update released with 13 changes, fixes '123456' password exposed chats for 64 million McDonald's job chatbot applications Hackers are exploiting critical RCE flaw in Wing FTP Server NVIDIA shares guidance to defend GDDR6 GPUs against Rowhammer attacks * BIOS * Firmware * GIGABYTE * Hardware * Motherboard * UEFI * Vulnerability * Vulnerability Scanner * * * * * Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. * Previous Article * Next Article Comments * deltasierra Photo deltasierra - 3 hours ago + + "However, the OEM has not published a security bulletin about the security problems that Binarly reported. BleepingComputer has emailed the hardware vendor a request for comment but we are still waiting for their response." The OEM (Gigabyte) didn't publish this security bulletin?: https://www.gigabyte.com/Support/Security/2302 Gigabyte said: "GIGA-BYTE Technology Co., Ltd. has identified multiple memory corruption vulnerabilities within the System Management Mode (SMM) modules used in several legacy GIGABYTE/ AORUS consumer motherboards. These vulnerabilities exist only on older Intel platforms where the affected SMM modules are implemented. Newer platforms are not impacted." For those concerned, check out their bulletin as it lists which Intel chipsets are affected and which ones have BIOS updates vs. which ones are hard EOL, e.g. Intel Z590 boards had updates released in June while Z370 is EOL. * NoneRain Photo NoneRain - 2 hours ago + + Interesting, @deltasierra. Using this mobo as an example: https://www.gigabyte.com/Motherboard/Z590-GAMING-X-rev-1x/support Assuming their BIOS upd released in Jun 10th is about these vuls, they didn't report the fix til Binarly made their public disclosure. - Gigabyte report: 10/Jul - Binarly public disclosure: 10/Jul (based on their own timeline) The strange part is that Gigabyte's report does not mention Binarly, claiming they identified the issues themselves, and according to Binarly's timeline, Gigabyte confirmed the issue on June 12th -- two days after releasing the BIOS update. Their report does not include CVE-2025-7028, tho. * deltasierra Photo deltasierra - 2 hours ago + + That is strange @NoneRain. They mentioned Eclypsium in a previous security-invoked BIOS update on that same mobo a few years back. As for the bulletin coming one month later, that must be Gigabyte's internal policy to disclose specific vulnerabilities 30 days / 1 month after patches become available. Some do it like that and others are same-day like MS Patch Tuesday. I also noticed that CVE was missed... not sure what that's about, lol. Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] Popular Stories * McDonald's '123456' password exposed chats for 64 million McDonald's job chatbot applications * NVIDIA NVIDIA shares guidance to defend GDDR6 GPUs against Rowhammer attacks * Gmail Google Gemini flaw hijacks email summaries for phishing Sponsor Posts * Why CISOs Are Replacing Legacy MFA With Phishing-Proof, Biometric Authentication Why CISOs Are Replacing Legacy MFA With Phishing-Proof, Biometric Authentication * Overdue a password health-check? Audit your Active Directory for free Overdue a password health-check? Audit your Active Directory for free * Still exposing RDP to the internet? Secure it instantly with TruGrid SecureRDP. Still exposing RDP to the internet? Secure it instantly with TruGrid SecureRDP. * Learn about Scattered Spider's evolving TTPs and how to defend your organization Learn about Scattered Spider's evolving TTPs and how to defend your organization * Can you trust your extensions? Discover Koi's zero-trust approach to software security Can you trust your extensions? Discover Koi's zero-trust approach to software security Follow us: * * * * * Main Sections * News * VPN Buyer Guides * SysAdmin Software Guides * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2025 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT