VULNERABILITY INTELLIGENCE

CVE-2017-13083

CVSS score5.3 MEDIUM

EPSS probability0.96%

CISA KEVNot currently listed

Published2017-10-18

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Description

Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an attacker to easily convince a user to execute arbitrary code

Weakness classification

CWE-295: Improper Certificate Validation
CWE-345: Insufficient Verification of Data Authenticity
CWE-347: Improper Verification of Cryptographic Signature
CWE-494: Download of Code Without Integrity Check

Primary references

cret@cert.org — Third Party Advisory, US Government Resource
cret@cert.org — Third Party Advisory, VDB Entry
cret@cert.org — Third Party Advisory
cret@cert.org — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory