PT-2017-18605 · Aeroadmin · Aeroadmin

Juan Manuel Fernandez + 1 · Published 2017-07-02 · Updated 2017-07-07 · CVE-2017-8894

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AeroAdmin version 4.1

Description The issue concerns the use of an insecure protocol, specifically HTTP, for software updates. This allows an attacker to potentially hijack an update through a man-in-the-middle attack, enabling them to execute code on the machine.

Recommendations For AeroAdmin version 4.1, consider disabling the automatic update feature until a secure update mechanism is implemented, and restrict network access to trusted sources to minimize the risk of exploitation.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2017-8894

Affected Products

Aeroadmin

References · 3

• 🔥 https://tarlogic.com/advisories/Tarlogic-2017-001.txt · Exploit
• https://osv.dev/vulnerability/CVE-2017-8894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8894 · Security Note