CVE-2017-16568 - CVE House
Back to Database
Status published Medium CVE-2017-16568

Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0,...

Vulnerability Description

Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. This vulnerability allows attackers to inject malicious JavaScript payloads, which become permanently stored on the server and execute when a user plays the compromised radio stream. Exploitation of this vulnerability can lead to Session hijacking and unauthorized access, Persistent manipulation of web content within the application, and Phishing or malicious redirects to external domains. This vulnerability can be exploited to manipulate media server behavior in enterprise and home network environments.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-16568

Credits & Attribution

No credits recorded in the NVD database.

References

More from logitech

View All →
CVE-2022-36263
StreamLabs Desktop Application 1.9.0 is vulnerable to Incorrect Access Control...
High 7.3
CVE-2021-38547
Logitech Z120 and S120 speakers through 2021-08-09 allow remote attackers...
Medium 5.9
CVE-2019-13055
Certain Logitech Unifying devices allow attackers to dump AES keys...
Medium 6.5
CVE-2019-13054
The Logitech R500 presentation clicker allows attackers to determine the...
Medium 6.5
CVE-2019-13053
Logitech Unifying devices allow keystroke injection, bypassing encryption. The attacker...
Medium 6.5

Affected Vendor

Affected Software

media server
Vulnerable Versions:
7.9.0

Timeline

Official Publish: November 9th, 2017
Last Modified: February 4th, 2025
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.