CVE-2017-6445 The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A man-in-the-middle attacker could manipul...
HighCVSS 8.1
EPSS 1.00%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A man-in-the-middle attacker could manipulate the update packages to gain root access remotely.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openelec | = 6.0.3 | No fix listed |
| openelec | = 7.0.1 | No fix listed |
References
- 96580 vdb-entry
- tech.feedyourhead.at
- tech.feedyourhead.at exploit technical-description third-party-advisory