CVE-2017-17877

{"id": "CVE-2017-17877", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-12-27T17:08:21.060", "references": [{"url": "https://blogger.davidmanouchehri.com/2017/12/steam-link-security-remotely-insecure.html", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/ValveSoftware/steamlink-sdk#ssh-access", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/ValveSoftware/steamlink-sdk/issues/119", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet (with stateless address autoconfiguration) by default, which makes it easier for remote attackers to obtain access by guessing 24 bits of the MAC address and attempting a root login. This can be exploited in conjunction with CVE-2017-17878."}, {"lang": "es", "value": "Se ha descubierto un problema en la build 643 de Valve Steam Link. Cuando el demonio SSH est\u00e1 activado para desarrollo local, el dispositivo est\u00e1 disponible p\u00fablicamente mediante el puerto 22 de TCP IPv6 en internet (con una autoconfiguraci\u00f3n de direcci\u00f3n sin estado) por defecto. Esto facilita a los atacantes remotos obtener acceso adivinando 24 bits de la direcci\u00f3n MAC e intentando iniciar sesi\u00f3n como root. Esto se puede explotar junto con CVE-2017-17878."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:valvesoftware:steam_link_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E520167E-6F54-473E-9839-C47814137C7A", "versionEndExcluding": "644"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:valvesoftware:steam_link:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EAAF46A5-190A-4578-8010-23DE5E75C898"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}