VULNERABILITY INTELLIGENCE

CVE-2017-11400

CVSS score6.8 MEDIUM
EPSS probability0.27%
CISA KEVNot currently listed
Published2017-11-20
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00. An incomplete firmware signature allows a local attacker to upgrade the equipment (kernel, file system) with unsigned, attacker-controlled, data. This occurs because the appliance_config file is signed but the .tar.sec file is unsigned.

Weakness classification

  • CWE-347: Improper Verification of Cryptographic Signature

Primary references