CVE-2017-17877

Critical

Published: 27/12/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An issue was discovered in Valve Steam Link build 643 related to the availability of the SSH daemon. When the SSH daemon is enabled for local development, the device is publicly accessible via IPv6 TCP port 22 by default, making it easier for remote attackers to gain access by guessing 24 bits of the MAC address and attempting a root login.

Risk Assessment

The availability of the SSH daemon on a public network poses a serious security risk, allowing remote attackers potential control over the device.

Recommendation

It is recommended to disable the SSH daemon if it is not needed or to implement appropriate security measures, such as restricting access to trusted IP addresses.

Original NVD description (English source)

An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet (with stateless address autoconfiguration) by default, which makes it easier for remote attackers to obtain access by guessing 24 bits of the MAC address and attempting a root login. This can be exploited in conjunction with CVE-2017-17878.