CVE-2017-17704
HIGH
7,4
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: high
MEDIUM
5,8
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: none
Confidentiality: none
Integrity: partial
Availability: partial
Description
AI Translation Available
A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode and restarts with the fixed IV, leading to replay attacks of entire messages. There is no authentication of messages beyond the use of the fixed AES key, so message forgery is also possible.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0016
Percentile
0,4th
Updated
EPSS Score Trend (Last 90 Days)
330
Use of Insufficiently Random Values
StableCommon Consequences
Security Scopes Affected:
Confidentiality
Other
Access Control
Potential Impacts:
Other
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Applicable Platforms
All platforms may be affected
Operating System
Istar Ultra Firmware by Swhouse
Version Range Affected
To
6.5.2.20569
(inclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:o:swhouse:istar_ultra_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://systemoverlord.com/2017/12/18/cve-2017-17704-broken-cryptography-in-ist…
https://systemoverlord.com/2017/12/18/cve-2017-17704-broken-cryptography-in-ist…