CVEvulnerability
CVE-2017-9457
6.7 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-07-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.7 MEDIUM — CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-20
Description
Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS.
Affected configurations
• compulab intense pc firmware (<= cr 2.2.0.400.2)
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://packetstormsecurity.com/files/143481/Compulab-Intense-PC-MintBox-2-Signature-Verification.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2017/Jul/56 Mailing List, Third Party Advisory
- https://watchmysys.com/blog/2017/07/cve-2017-9457-compulab-intense-pc-lacks-firmware-validation/ Third Party Advisory
- http://packetstormsecurity.com/files/143481/Compulab-Intense-PC-MintBox-2-Signature-Verification.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2017/Jul/56 Mailing List, Third Party Advisory
- https://watchmysys.com/blog/2017/07/cve-2017-9457-compulab-intense-pc-lacks-firmware-validation/ Third Party Advisory