Researchers from cyber-security firm Cylance disclosed two vulnerabilities in the firmware of Gigabyte BRIX small computing devices. The flaws allow an attacker to write malicious content to the UEFI firmware. Gigabyte devices affected include GB-BSi7H-6500 and GB-BXi7-5775 (firmware version vF2) CERT/CC has issued an official Vulnerability Bote (VU#507496) for both flaws. Researchers installed a proof-of-concept UEFI ransomware, but the same flaws can be used to plant rootkits that allow attackers to persist malware for years.
Source: https://www.bleepingcomputer.com/news/security/gigabyte-firmware-flaws-allow-the-installation-of-uefi-ransomware/