CVE-2017-8894

High

Published: 02/07/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

AeroAdmin 4.1 uses an insecure protocol (HTTP) to perform software updates. An attacker can hijack an update via man-in-the-middle in order to execute code on the machine.

Risk Assessment

The risk to the organization is the potential for remote code execution by an attacker, which could lead to system and data compromise.

Recommendation

It is recommended to switch to a secure protocol (HTTPS) for performing software updates to minimize the risk of attacks.

Other vulnerabilities in AeroAdmin 4.1

CVE-2017-8893High
AeroAdmin 4.1 uses a function to copy data between two pointers where the size of the data copied is taken directly from a network packet. This can cause a buffer overflow and denial of service.

Original NVD description (English source)

AeroAdmin 4.1 uses an insecure protocol (HTTP) to perform software updates. An attacker can hijack an update via man-in-the-middle in order to execute code in the machine.