CVE-2017-6466 - CVE House
Back to Database
Status published High CVE-2017-6466

F-Secure Software Updater 2.20, as distributed in several F-Secure products,...

Vulnerability Description

F-Secure Software Updater 2.20, as distributed in several F-Secure products, downloads installation packages over plain http and does not perform file integrity validation after download. Man-in-the-middle attackers can replace the file with their own executable which will be executed under the SYSTEM account. Note that when Software Updater is configured to install updates automatically, it checks if the downloaded file is digitally signed by default, but does not check the author of the signature. When running in manual mode (default), no signature check is performed.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-6466

Credits & Attribution

No credits recorded in the NVD database.

References

More from f-secure

View All →
CVE-2022-47524
F-Secure SAFE Browser 19.1 before 19.2 for Android allows an...
Unknown 0
CVE-2022-45871
Denial-of-Service (DoS) Vulnerability
Medium 4.3
CVE-2022-38166
In F-Secure Endpoint Protection for Windows and macOS before channel...
Unknown 0
CVE-2022-38164
A vulnerability affecting F-Secure SAFE browser for Android and iOS...
Unknown 0
CVE-2022-38163
A Drag and Drop spoof vulnerability was discovered in F-Secure...
Unknown 0

Affected Vendor

Affected Software

software updater
Vulnerable Versions:
2.20

Timeline

Official Publish: March 11th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.