PT-2017-14962 · Software House · Ip-Acm Ethernet Door Module+1

David Tomaschik · Published 2017-12-31 · Updated 2019-10-03 · CVE-2017-17704

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Software House iStar Ultra versions through 6.5.2.20569

Description A door-unlocking issue was discovered when the Software House iStar Ultra is used with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra use a fixed AES key and IV for encryption in CBC mode, which allows for replay attacks of entire messages. Additionally, the lack of message authentication beyond the fixed AES key enables message forgery.

Recommendations For versions through 6.5.2.20569, consider disabling the IP-ACM Ethernet Door Module until a patch is available to prevent potential replay attacks and message forgery. Restrict access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2017-17704

Affected Products

Ip-Acm Ethernet Door Module

Istar Ultra

References · 3

• https://osv.dev/vulnerability/CVE-2017-17704 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17704 · Security Note
• https://systemoverlord.com/2017/12/18/cve-2017-17704-broken-cryptography-in-istar-ultra-ip-acm-by-software-house.html · Note