CVE-2017-15567 — HIGH (7.8)

Vulnerability Description

The certificate import component in IDEMIA (formerly Morpho) MorphoSmart 1300 Series (aka MSO 1300 Series) devices allows local users to obtain a command shell, and consequently gain privileges, via unspecified vectors. NOTE: the vendor disputes this because there is no command shell in the product or in the associated SDK

CVSS Score

7.8

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Idemia	Mso 1300 Firmware	-
Idemia	Mso 1300	-

References

https://gist.github.com/shiham101/4c49ece8ecac7c3c02ecbc6942aeca80Third Party Advisory
https://gist.github.com/shiham101/4c49ece8ecac7c3c02ecbc6942aeca80Third Party Advisory

FAQ

What is CVE-2017-15567?

CVE-2017-15567 is a vulnerability with a CVSS score of 7.8 (HIGH). The certificate import component in IDEMIA (formerly Morpho) MorphoSmart 1300 Series (aka MSO 1300 Series) devices allows local users to obtain a command shell, and consequently gain privileges, via u...

How severe is CVE-2017-15567?

CVE-2017-15567 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-15567?

Check the references section above for vendor advisories and patch information. Affected products include: Idemia Mso 1300 Firmware, Idemia Mso 1300.