CVE-2017-9457 Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrato...
MediumCVSS 6.7
EPSS 0.83%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| compulab intense pc firmware | <= cr_2.2.0.400.2 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- 20170724 CVE-2017-9457 CompuLab Intense PC lacks firmware signature validation mailing-list third-party-advisory
- watchmysys.com third-party-advisory