Improper input validation in Compulab Intense Pc
CVE-2017-9457
Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.008 (53.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Compulab Intense_pc
- Compulab Intense_pc_firmware
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, x_refsource_FULLDISC, Mailing List, Third Party Advisory)
- cve@mitre.org (VDB Entry, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2017-9457?
- CVE-2017-9457 is a medium-severity vulnerability in Compulab Intense Pc, classified under Improper Input Validation. CVSS score: 6.7/10. Published 2017-07-25.
- How severe is CVE-2017-9457?
- Medium severity. CVSS v3 base score is 6.7 out of 10.