medium6.7
CVE-2017-9457
Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware.
Impact
Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Compulab | Intense Pc Firmware | through cr_2.2.0.400.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/143481/Compulab-Intense-PC-MintBox-2-Signature-Verification.html
- http://seclists.org/fulldisclosure/2017/Jul/56
- https://watchmysys.com/blog/2017/07/cve-2017-9457-compulab-intense-pc-lacks-firmware-validation/
- http://packetstormsecurity.com/files/143481/Compulab-Intense-PC-MintBox-2-Signature-Verification.html
- http://seclists.org/fulldisclosure/2017/Jul/56
- https://watchmysys.com/blog/2017/07/cve-2017-9457-compulab-intense-pc-lacks-firmware-validation/