CVE-2017-17877: Critical severity Valvesoftware Steam Link Firmware vulnerability
An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet (with stateless address autoconfiguration) by default, which makes it easier for remote attackers to obtain access by guessing 24 bits of the MAC address and attempting a root login. This can be exploited in conjunction with CVE-2017-17878.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-17877?
CVE-2017-17877 is a vulnerability discovered in Valve Steam Link build 643 that allows remote attackers to gain access to the device through the SSH daemon.
What is the severity of CVE-2017-17877?
CVE-2017-17877 has a severity score of 9.8, which is considered critical.
How can I fix CVE-2017-17877?
To fix CVE-2017-17877, it is recommended to update Valve Steam Link firmware to version 644 or higher.
What software is affected by CVE-2017-17877?
Valve Steam Link firmware versions up to 644 are affected by CVE-2017-17877.
Where can I find more information about CVE-2017-17877?
You can find more information about CVE-2017-17877 at the following references: [1](https://blogger.davidmanouchehri.com/2017/12/steam-link-security-remotely-insecure.html), [2](https://github.com/ValveSoftware/steamlink-sdk#ssh-access), [3](https://github.com/ValveSoftware/steamlink-sdk/issues/119)