CVE-2017-11400: belden tofino_xenon_security_appliance_firmware
Vulnerability summary
CVE-2017-11400 is a high (CVSS 7.2) vulnerability in belden tofino_xenon_security_appliance_firmware. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.4% of scored vulnerabilities.
Timeline
- 20-11-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00. An incomplete firmware signature allows a local attacker to upgrade the equipment (kernel, file system) with unsigned, attacker-controlled, data. This occurs because the appliance_config file is signed but the .tar.sec file is unsigned.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
18%
Versus all other CVEs
30-day change
0.00 pp
From 0.27% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Belden1 product
1 vendor · 1 product
References
2 links- www.belden.com/hubfs/support/security/bulletins/Belden-Security-Bulletin-BSECV-2017-14-1v1-1.pdfX Refsource MISCVendor Advisory
- github.com/airbus-seclab/security-advisories/blob/master/belden/tofino.txtX Refsource MISCThird Party Advisory