CVEvulnerability

CVE-2017-17704

7.4 HIGH Published 2017-12-31 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-12-31
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.4 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:P
Weaknesses
CWE-330

Description

A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode and restarts with the fixed IV, leading to replay attacks of entire messages. There is no authentication of messages beyond the use of the fixed AES key, so message forgery is also possible.

Affected configurations

• swhouse istar ultra firmware (<= 6.5.2.20569)

Related

Weakness · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

Referenced by CWE · observed example (2)

  • CWE-1204 Generation of Weak Initialization Vector (IV) weakness
  • CWE-329 Generation of Predictable IV with CBC Mode weakness

References