Actively exploited in the wild
GIGABYTE Multiple Products Code Execution Vulnerability
GIGABYTE - Multiple Products · Listed in the CISA KEV since 2022-10-24. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2018-19322
HighCVSS 7.8KEVExploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center and other tools expose functionality to read/write data from/to IO ports. This could be leveraged to run code with elevated privileges.
Risk Assessment
An attacker could use IO port access to manipulate hardware and run malicious code with administrator privileges, potentially leading to full system compromise.
Recommendation
Update GIGABYTE software to versions that fix these drivers and monitor systems for unauthorized activities.
Original NVD description (English source)
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.