CVE-2017-17860 json
In Samsung Gear products, Bluetooth link key is updated to the different key which is same with attacker's link key.
published 2018-01-18 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-9007
- cvss
- 5.7
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
In Samsung Gear products, Bluetooth link key is updated to the different key which is same with attacker's link key. It can be attacked without user's intention only if attacker can reveal the Bluetooth address of target device and paired user's smartphone
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- drive.google.com https://drive.google.com/open?id=0B5L-0MoH_v7fcGljUS1SYnlkOHM referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.7 | CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.7 | AV:A/AC:M/Au:N/C:N/I:N/A:C |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
drive.google.com
/open?id=0B5L-0MoH_v7fcGljUS1SYnlkOHM
exploit, third-party-advisory
Sources
- CVE List CVE-2017-17860
- NVD CVE-2017-17860
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.