« Volver al listado

CVE-2017-14202

Estado: ModificadaAlta (7.8)—

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash, possibly with arbitrary code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zephyrproject — Zephyr

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-14202",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "vulnerabilities@zephyrproject.org",
      "affectedData": [
        {
          "vendor": "Zephyr",
          "product": "shell",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 1.14.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-08-29T01:15:10.740",
  "references": [
    {
      "url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "vulnerabilities@zephyrproject.org"
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/pull/13048",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "vulnerabilities@zephyrproject.org"
    },
    {
      "url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18",
      "tags": [
        "Broken Link"
      ],
      "source": "vulnerabilities@zephyrproject.org"
    },
    {
      "url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/pull/13048",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vulnerabilities@zephyrproject.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash, possibly with arbitrary code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all."
    },
    {
      "lang": "es",
      "value": "Una Restricción Inapropiada de Operaciones dentro de los Límites de una vulnerabilidad del Búfer de la Memoria en el componente shell de Zephyr, permite a un usuario conectado serial o telnet causar un bloqueo, posiblemente con la ejecución de código arbitrario. Este problema afecta a: shell de Zephyr versiones anteriores a 1.14.0 sobre todo."
    }
  ],
  "lastModified": "2026-06-17T01:05:46.280",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "824F6D6D-B539-4424-BC2E-D4532017038F",
              "versionEndExcluding": "1.14.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnerabilities@zephyrproject.org"
}