CVE-2017-17704 describes a critical door-unlocking vulnerability affecting Software House iStar Ultra devices up to version 6.5.2.20569 when used with the IP-ACM Ethernet Door Module. The issue stems from the use of a fixed AES key and IV for encrypting communications, enabling replay and forgery attacks due to a lack of proper authentication. With a CVSS score of 7.4 (HIGH), this vulnerability has a network attack vector and high impact on integrity and availability, allowing an unauthenticated attacker to unlock doors and potentially disrupt operations. The attack complexity is rated as high, indicating some specialized conditions or knowledge are required. There is no evidence of active exploitation, nor is public exploit code available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 6.5.2.20569CPE matchmatch criteria | cpe:2.3:o:swhouse:istar_ultra_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.