CVE-2017-11400

MEDIUM

6.8

CVSS Severity Score

EPSS Score0.1360%

EPSS Percentile1.70th

PublishedNov 20, 2017

Last ModifiedMay 13, 2026

Vulnerability Description

An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00. An incomplete firmware signature allows a local attacker to upgrade the equipment (kernel, file system) with unsigned, attacker-controlled, data. This occurs because the appliance_config file is signed but the .tar.sec file is unsigned.

Affected Platforms (CPE)

💻

Belden

Tofino Xenon Security Appliance Firmware

<= 3.1.0

References & Advisories

🔗 https://github.com/airbus-seclab/security-advisories/blob/master/belden/tofino.txt

🔗 https://www.belden.com/hubfs/support/security/bulletins/Belden-Security-Bulletin-BSECV-2017-14-1v1-1.pdf