CVE-2017-17704

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode and restarts with the fixed IV, leading to replay attacks of entire messages. There is no authentication of messages beyond the use of the fixed AES key, so message forgery is also possible.

Metrics

CVSS 3.0 7.4/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-330

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 31, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-177078.1Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in PleasCVE-2017-177084.3Because of insufficient authorization checks it is possible for any authenticated user to change profile data of other users in Pleasant PasCVE-2017-177127.0The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl that leads to uninitiaCVE-2017-177139.8Trape before 2017-11-05 has SQL injection via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /regisCVE-2017-177146.1Trape before 2017-11-05 has XSS via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register countrCVE-2017-177158.8The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal vCVE-2017-177165.9GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4CVE-2017-177179.8Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration featureCVE-2017-177185.9The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation.CVE-2017-177196.1A cross-site scripting (XSS) vulnerability in the wp-concours plugin through 1.1 for WordPress allows remote attackers to inject arbitrary wCVE-2017-17726.1IBM Worklight (IBM MobileFirst Platform Foundation 6.3, 7.0, 7.1, and 8.0) is vulnerable to cross-site scripting. This vulnerability allows CVE-2017-177219.8CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, assignto, building, dom