UEFI Firmware Vulnerability Leaves Major Motherboards Open to Early-Boot DMA Attacks
In December 2025, researchers disclosed a critical hardware/firmware vulnerability impacting various ASRock, ASUS, GIGABYTE, and MSI motherboards. The flaw allows threat actors to launch direct memory access (DMA) attacks during the early boot process, bypassing typical Unified Extensible Firmware Interface (UEFI) and Input–Output Memory Management Unit (IOMMU) protections. Attackers can exploit this window to inject code or access sensitive memory before system defenses activate. The incident exposes endpoints to risk of credential theft, persistent malware implants, and lateral movement, with potential compromise of high-value IT and OT assets. This incident is highly relevant as firmware attacks and supply chain risks escalate, especially with the push towards Zero Trust security architectures. Hardware-level exposures pose challenges that traditional endpoint or network controls may not immediately mitigate, requiring urgent attention to firmware security and early-boot exploit detection.
Kill Chain
