How severe is CVE-2017-6466?

This vulnerability has a severity rating of HIGH with a CVSS score of 8.1 out of 10.

What type of vulnerability is CVE-2017-6466?

This is classified as CWE-20, which is a common weakness in software security.

CVE-2017-6466 - HIGH Severity | CVSS 8.1

Vulnerability Description

F-Secure Software Updater 2.20, as distributed in several F-Secure products, downloads installation packages over plain http and does not perform file integrity validation after download. Man-in-the-middle attackers can replace the file with their own executable which will be executed under the SYSTEM account. Note that when Software Updater is configured to install updates automatically, it checks if the downloaded file is digitally signed by default, but does not check the author of the signature. When running in manual mode (default), no signature check is performed.

Related Vulnerabilities

CVE-2007-5928

HIGH

CVSS:8.1(High)

OpenBase 10.0.5 and earlier allows remote authenticated users to trigger a free of an arbitrary memory location via long strings in a SELECT statement. NOTE: this might be a buffer overflow, but it is...

CWE-202007

CVE-2012-2248

HIGH

CVSS:8.1(High)

An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable.

CWE-202012

CVE-2013-2103

HIGH

CVSS:8.1(High)

OpenShift cartridge allows remote URL retrieval

CWE-202013

CVE-2013-4751

HIGH

CVSS:8.1(High)

php-symfony2-Validator has loss of information during serialization

CWE-202013

CVE-2014-2271

HIGH

CVSS:8.1(High)

cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the HTTPS connection to the registry fails, w...

CWE-202014

CVE-2014-5282

HIGH

CVSS:8.1(High)

Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'.

CWE-202014