What’s Vulnerable › Vulnerabilities

CVE-2017-17428

• Severity: medium (CVSS 5.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-03-05 · updated 2026-06-17
• Weakness: CWE-327

Description

Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.

Affected products

• Cavium Nitrox Ssl Sdk: through 6.1.0
• Cavium Nitrox V Ssl Sdk: through 1.2
• Cavium Octeon Sdk: through 1.7.2
• Cavium Octeon Ssl Sdk: through 1.5.0
• Cavium Turbossl Sdk: through 1.0
• Cisco Ace30 Application Control Engine Module Firmware: 3.0(0)a5(2.0), 3.0(0)a5(3.0), 3.0(0)a5(3.5)
• Cisco Ace4710 Application Control Engine Firmware: 3.0(0)a5(2.0), 3.0(0)a5(3.0), 3.0(0)a5(3.5)
• Cisco Adaptive Security Appliance 5505 Firmware: 9.1(7.16)
• Cisco Adaptive Security Appliance 5510 Firmware: 9.1(7.16)
• Cisco Adaptive Security Appliance 5520 Firmware: 9.1(7.16)
• Cisco Adaptive Security Appliance 5540 Firmware: 9.1(7.16)
• Cisco Adaptive Security Appliance 5550 Firmware: 9.1(7.16)
• Cisco Webex Conect Im: 7.24.1
• Cisco Webex Meetings: t31, t32

References

• http://www.securityfocus.com/bid/102170
• http://www.securitytracker.com/id/1039984
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher
• https://www.cavium.com/security-advisory-cve-2017-17428.html
• https://www.kb.cert.org/vuls/id/144389
• http://www.securityfocus.com/bid/102170
• http://www.securitytracker.com/id/1039984
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher
• https://www.cavium.com/security-advisory-cve-2017-17428.html
• https://www.kb.cert.org/vuls/id/144389

Get alerted when CVE-2017-17428 or the next vulnerability affects your stack