PT-2017-17128 · Bose · Bose Soundtouch 30

Published 2017-05-01 · Updated 2017-05-16 · CVE-2017-6520

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions BOSE Soundtouch 30 (affected versions not specified)

Description The issue concerns the Multicast DNS (mDNS) responder in the BOSE Soundtouch 30, which incorrectly responds to IPv4 unicast queries from non-link-local source addresses. This behavior allows remote attackers to potentially cause a denial of service through traffic amplification or obtain sensitive information by sending UDP packets to port 5353.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-417

Related Identifiers

CVE-2017-6520

Affected Products

Bose Soundtouch 30

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2017-6520 · Security Note
• https://secfu.net/advisories · Note