PT-2017-17652 · Riverbed · Riverbed Rios

Jean-Christophe Baptiste + 1 · Published 2017-04-04 · Updated 2024-08-05 · CVE-2017-7306

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Riverbed RiOS versions prior to 9.6.1

Description The issue is related to a weak default password for the secure vault in Riverbed RiOS, which can be exploited by physically proximate attackers who have knowledge of the password algorithm and the appliance serial number. This weakness can be used to defeat the secure-vault protection mechanism. It's noted that the vendor does not consider this a vulnerability as the product allows for arbitrary password changes by customers, although such changes are optional.

Recommendations For Riverbed RiOS versions prior to 9.6.1, change the default password for the secure vault to a strong, unique password to prevent exploitation. Consider implementing additional security measures to protect against physically proximate attackers.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2017-7306

Affected Products

Riverbed Rios

References · 7

• 🔥 http://seclists.org/fulldisclosure/2017/Feb/25 · Exploit
• https://supportkb.riverbed.com/support/index?page=content&id=S30065 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7306 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7306 · Security Note
• https://t.me/cvenotify/88219 · Telegram Post
• https://t.me/cvenotify/89224 · Telegram Post
• https://t.me/cvenotify/87157 · Telegram Post