CVE-2017-11830 json
Device Guard in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to ma…
published 2017-11-15 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-3430
- cvss
- 5.3
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.6%
- EPSS 2.6% chance of exploitation in 30 days, percentile 85%
- public exploits
- 1
- Exploit-DB
Summary
Device Guard in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to make an unsigned file appear to be signed, due to a security feature bypass, aka "Device Guard Security Feature Bypass Vulnerability".
Patch / fix
Timeline
- Published
- First public exploit (EDB-43162)
Exploit prediction
2.57% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-43162 Microsoft Windows 10 - CiSetFileCache TOCTOU Security Feature Bypass local, 2017-11-20
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.3 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- Microsoft Corporation Device Guard
Classification
- Weakness
-
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
References
-
portal.msrc.microsoft.com
/en-US/security-guidance/advisory/CVE-2017-11830
patch, vendor-advisory
-
exploit-db.com
/exploits/43162/
exploit, technical-description, third-party-advisory, vdb-entry
-
securitytracker.com
/id/1039790
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/101714
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2017-11830
- NVD CVE-2017-11830
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.