CVE-2017-17860: Input Validation
In Samsung Gear products, Bluetooth link key is updated to the different key which is same with attacker's link key. It can be attacked without user's intention only if attacker can reveal the Bluetooth address of target device and paired user's smartphone
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Samsung Gear product vulnerability?
The vulnerability ID for this Samsung Gear product vulnerability is CVE-2017-17860.
What is the severity rating of CVE-2017-17860?
CVE-2017-17860 has a severity rating of 5.7, which is considered medium.
Which Samsung Gear products are affected by CVE-2017-17860?
CVE-2017-17860 affects Samsung Gear S2 and Samsung Gear S3.
What is the impact of CVE-2017-17860?
CVE-2017-17860 allows attackers to update the Bluetooth link key to the same key as the attacker's link key, potentially leading to unauthorized access to the device.
How can CVE-2017-17860 be exploited?
CVE-2017-17860 can be exploited if the attacker is able to reveal the Bluetooth address of the target device and paired user's smartphone.