Vulnerability in Swhouse Istar Ultra
CVE-2017-17704
A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode and restarts with the fixed IV, leading to replay attacks of entire messages. There is no authentication of messages beyond the use of the fixed AES key, so message forgery is also possible.
EPSS: 0.010 (59.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H.
Affected products
- Swhouse Istar_ultra
- Swhouse Istar_ultra_firmware
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2017-17704?
- CVE-2017-17704 is a high-severity vulnerability in Swhouse Istar Ultra, classified under Use of Insufficiently Random Values. CVSS score: 7.4/10. Published 2017-12-31.
- How severe is CVE-2017-17704?
- High severity. CVSS v3 base score is 7.4 out of 10.