PT-2017-11983 · Belden Hirschmann · Tofino Xenon Security Appliance

Publicado 2017-11-20 · Atualizado 2022-04-04 · CVE-2017-11400

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Belden Hirschmann Tofino Xenon Security Appliance versions prior to 03.2.00

Description An issue has been discovered that allows a local attacker to upgrade the equipment with unsigned, attacker-controlled data due to an incomplete firmware signature. This occurs because the appliance config file is signed, but the .tar.sec file is unsigned.

Recommendations For versions prior to 03.2.00, update to version 03.2.00 or later to resolve the issue. As a temporary workaround, consider restricting local access to the appliance to minimize the risk of exploitation.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2017-11400

Produtos afetados

Tofino Xenon Security Appliance

Referências · 6

• https://github.com/airbus-seclab/security-advisories/blob/master/belden/tofino.txt · Nota
• https://osv.dev/vulnerability/CVE-2017-11400 · Aviso do Fabricante
• https://t.me/cibsecurity/40082 · Publicação no Telegram
• https://belden.com/hubfs/support/security/bulletins/Belden-Security-Bulletin-BSECV-2017-14-1v1-1.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11400 · Nota de Segurança
• https://t.me/cvenotify/28367 · Publicação no Telegram