GIGABYTE Motherboards CVE-2025-14302

Requires physical access to the target device and a DMA-capable PCIe (or PCIe-tunneled, e.g. Thunderbolt) device, exploited during the pre-boot window before the OS kernel enables IOMMU/DMA remapping. The core precondition is the affected firmware configuration where IOMMU is not properly enabled early in boot on specific GIGABYTE motherboard models. Limiting factors: exploitation is impossible remotely (AV:P), requires proximity and hands-on hardware attachment, and the memory-access window closes once the OS kernel loads and establishes IOMMU protections; risk is concentrated on unattended, shared, or physically exposed machines.

This is a genuine hardware protection-mechanism failure (CWE-693) but its real-world risk is bounded almost entirely by the physical attack vector. The vendor CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 7.0) is internally consistent with the description: an unauthenticated attacker with physical access uses a DMA-capable PCIe device to read and write arbitrary physical memory during the pre-boot window, before IOMMU/OS kernel protections are established. Low complexity and no privileges/interaction required are accurate once physical access is obtained, but AV:P is the dominant limiter - this cannot be exploited remotely or over a network. EPSS is low (0.35%, 26th percentile), there is no CISA KEV listing, and no public exploit code was identified, which together indicate no evidence of opportunistic or widespread exploitation - consistent with a physical/evil-maid class issue rather than a mass-exploited one. Note the signals are not conflicting here: low EPSS, absence of KEV, and a physical vector all point the same direction. This is a real firmware/platform-security weakness worth patching on affected boards, but it is NOT a drop-everything remote priority; prioritize it for high-value, physically exposed, or unattended devices (kiosks, lab machines, laptops-in-transit-equivalent desktops).

An attacker with brief physical access to a powered or booting machine using an affected GIGABYTE motherboard attaches a malicious DMA-capable PCIe/Thunderbolt-attached device. Because IOMMU is not enabled in the pre-boot phase, the device performs direct memory reads and writes to arbitrary physical memory before the OS kernel and its protections load, allowing extraction of secrets or injection of code into early boot. No public exploit code was identified, though the technique mirrors well-documented pre-boot DMA attacks.