5.5

CVE-2017-8360

Exploit

EPSS 0.2%
Veröffentlicht 12.05.2017 07:29:00
Zuletzt bearbeitet 20.04.2025 01:37:25
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

Conexant Systems mictray64 task, as used on HP Elite, EliteBook, ProBook, and ZBook systems, leaks sensitive data (keystrokes) to any process. In mictray64.exe (mic tray icon) 1.0.0.46, a LowLevelKeyboardProc Windows hook is used to capture keystrokes. This data is leaked via unintended channels: debug messages accessible to any process that is running in the current user session, and filesystem access to C:\Users\Public\MicTray.log by any process.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 6

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Conexant ≫ Mictray64 Version <= 1.0.0.46

   Hp ≫ Elite X2 1012 G1 Version-
   Hp ≫ Elitebook 1030 G1 Version-
   Hp ≫ Elitebook 725 G3 Version-
   Hp ≫ Elitebook 745 G3 Version-
   Hp ≫ Elitebook 755 G3 Version-
   Hp ≫ Elitebook 820 G3 Version-
   Hp ≫ Elitebook 828 G3 Version-
   Hp ≫ Elitebook 840 G3 Version-
   Hp ≫ Elitebook 848 G3 Version-
   Hp ≫ Elitebook 850 G3 Version-
   Hp ≫ Elitebook Folio 1040 G3 Version-
   Hp ≫ Elitebook Folio G1 Version-
   Hp ≫ Probook 430 G3 Version-
   Hp ≫ Probook 440 G3 Version-
   Hp ≫ Probook 446 G3 Version-
   Hp ≫ Probook 450 G3 Version-
   Hp ≫ Probook 455 G3 Version-
   Hp ≫ Probook 470 G3 Version-
   Hp ≫ Probook 640 G2 Version-
   Hp ≫ Probook 645 G2 Version-
   Hp ≫ Probook 650 G2 Version-
   Hp ≫ Probook 655 G2 Version-
   Hp ≫ Zbook 15 G3 Version-
   Hp ≫ Zbook 15u G3 Version-
   Hp ≫ Zbook 17 G3 Version-
   Hp ≫ Zbook Studio G3 Version-
   Microsoft ≫ Windows 10
   Microsoft ≫ Windows 7

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.2%	0.425

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.5	1.8	3.6	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov	2.1	3.9	2.9	AV:L/AC:L/Au:N/C:P/I:N/A:N

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://www.securitytracker.com/id/1038527

https://www.modzero.ch/advisories/MZ-17-01-Conexant-Keylogger.txt

Third Party Advisory

Exploit

Mitigation

Technical Description

https://www.modzero.ch/modlog/archives/2017/05/11/en_keylogger_in_hewlett-packard_audio_driver/index.html

Third Party Advisory

Exploit

Technical Description

https://nvd.nist.gov/vuln/detail/CVE-2017-8360

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-8360

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-8360

EUVD