CVE-2017-6445

PoC —

CVSS 3.0

8.1 high

EPSS

<1%p61

Published

Mar 5, 2017 (Mar 5, 2017)

Modified

Jun 17, 2026

Description

The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A man-in-the-middle attacker could manipulate the update packages to gain root access remotely.

Vendors: openelec
Products: openelec
Weakness: CWE-311, CWE-347
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news0 stories

No ingested article mentions this CVE yet.