What’s Vulnerable › Vulnerabilities

CVE-2017-17878

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-12-27 · updated 2026-06-17
• Weakness: CWE-327

Description

An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES (aka the CONFIG_FEATURE_DEFAULT_PASSWD_ALGO="des" setting).

Affected products

• Valvesoftware Steam Link Firmware: before 644 — fixed in 644

How to fix

Upgrade to a fixed version: Valvesoftware Steam Link Firmware 644. Check the vendor advisory for mitigations.

References

• https://blogger.davidmanouchehri.com/2017/12/steam-link-security-truncated-password.html
• https://github.com/ValveSoftware/steamlink-sdk/issues/101
• https://github.com/ValveSoftware/steamlink-sdk/issues/110
• https://blogger.davidmanouchehri.com/2017/12/steam-link-security-truncated-password.html
• https://github.com/ValveSoftware/steamlink-sdk/issues/101
• https://github.com/ValveSoftware/steamlink-sdk/issues/110

Get alerted when CVE-2017-17878 or the next vulnerability affects your stack