CVE-2017-8894

HIGH

AeroAdmin 4.1 - Remote Code Execution via Insecure HTTP Update Channel

Title source: llm

Description

AeroAdmin 4.1 uses an insecure protocol (HTTP) to perform software updates. An attacker can hijack an update via man-in-the-middle in order to execute code in the machine.

References (1)

Core 1

Core References

Exploit, Vendor Advisory x_refsource_misc

https://www.tarlogic.com/advisories/Tarlogic-2017-001.txt

Scores

CVSS v3 8.1

EPSS 0.0158

EPSS Percentile 72.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-444

Status published

Products (1)

aeroadmin/aeroadmin 4.1

Published Jul 02, 2017

Tracked Since Feb 18, 2026