CVE-2017-17428
Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote...
Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.
- Record
CVE-2017-17428- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 7.1 High
AV:N/AC:M/Au:N/C:C/I:N/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
CVE List No score
Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.
- Record
CVE-2017-17428- Updated
- 2026-11-02
EUVDEUVD-2017-8593 No score
Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.
- Record
EUVD-2017-8593- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gw93-27cv-rc7m
Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote...
Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.
- Record
GHSA-gw93-27cv-rc7m- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
Affected products
- cavium nitrox ssl sdk
- cavium nitrox v ssl sdk
- cavium octeon sdk
- cavium octeon ssl sdk
- cavium turbossl sdk
- cisco ace30 application control engine module firmware
- cisco ace4710 application control engine firmware
- cisco adaptive security appliance 5505 firmware
- cisco adaptive security appliance 5510 firmware
- cisco adaptive security appliance 5520 firmware
- cisco adaptive security appliance 5540 firmware
- cisco adaptive security appliance 5550 firmware
Show 2 moreShow less
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Scanner for Bleichenbacher Oracle in RSA PKCS #1 v1.5 | 2009-06-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-17428 is a medium vulnerability (CVSS 5.9) in Cavium Nitrox Ssl Sdk, published March 5, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 14.6%, the 96th percentile. No source names a fixed version.
References
securityfocus.com/bid/102170
cavium.com/security-advisory-cve-2017-17428.html
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher
securitytracker.com/id/1039984
kb.cert.org/vuls/id/144389
nvd.nist.gov/vuln/detail/CVE-2017-17428
github.com/advisories/GHSA-gw93-27cv-rc7m