PatchTheCVECVE-2017-17704: A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in c
CVE-2017-17704 is a high-severity flaw (CVSS 7.4) affecting istar ultra firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode and restarts with the fixed IV, leading to replay attacks of entire messages. There is no authentication of messages beyond the use of the fixed AES key
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.4 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.0% (top 37%) |
| CISA exploited list | No |
| Weakness | CWE-330 |
| Published | 2017-12-31 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2017-17704?
istar ultra firmware: upgrade to newer than 6.5.2.20569. Exact commands for each OS are on this page.
Is CVE-2017-17704 being exploited?
CVE-2017-17704 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2017-17704 affect?
CVE-2017-17704 affects istar ultra firmware. Severity is high (CVSS 7.4). A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fi
How urgent is CVE-2017-17704?
Priority 47/100. High severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2023-3127 HIGH 7.5 UPGRADE UPGRADE An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with adm
- CVE-2022-21941 CRITICAL 10.0 UPGRADE All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow