CVE-2017-3218

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295 CWE-311 CWE-345

Affected software

Vendor	Product	Versions
Samsung	Magician	<5.1

References

http://www.securityfocus.com/bid/99081Third Party Advisory, VDB Entry
https://www.kb.cert.org/vuls/id/846320Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/99081Third Party Advisory, VDB Entry
https://www.kb.cert.org/vuls/id/846320Third Party Advisory, US Government Resource

Timeline

Published: Jun 21, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-32198.8Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified us CVE-2017-32219.8Blind SQL injection in Inmarsat AmosConnect 8 login form allows remote attackers to access user credentials, including user names and passwo CVE-2017-32229.8Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute comm CVE-2017-32239.8Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be CVE-2017-32248.2Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSe CVE-2017-32254.6Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encrypt CVE-2017-32266.4Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. Devices that make use of Das U-Boot's AES-CBC CVE-2017-32308.6Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder). Supported version CVE-2017-32314.3Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected CVE-2017-32325.5Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version th CVE-2017-32337.5Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version th CVE-2017-32349.8Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version th