CVE-2017-16567 - CVE House

Back to Database

Status published Medium CVE-2017-16567

Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0,...

5.4 CVSS

Vulnerability Description

Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. This vulnerability allows remote attackers to inject and permanently store malicious JavaScript payloads, which are executed when users access the affected functionality. Exploitation of this vulnerability can lead to Session Hijacking and Credential Theft, Execution of unauthorized actions on behalf of users, and Exfiltration of sensitive data. This vulnerability presents a potential risk for widespread exploitation in connected IoT environments.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-16567

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://www.exploit-db.com/exploits/43122/

More from logitech

View All →

StreamLabs Desktop Application 1.9.0 is vulnerable to Incorrect Access Control...

Logitech Z120 and S120 speakers through 2021-08-09 allow remote attackers...

Certain Logitech Unifying devices allow attackers to dump AES keys...

The Logitech R500 presentation clicker allows attackers to determine the...

Logitech Unifying devices allow keystroke injection, bypassing encryption. The attacker...

Affected Vendor

logitech

View all reports →

Affected Software

media server

Vulnerable Versions:

7.9.0

Timeline

Official Publish: November 9th, 2017

Last Modified: February 4th, 2025

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.