Read the docs
TI-2017-08427 Aliases CVE-2017-11400GHSA-mrc4-5458-65m9

An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance…

Priority LOW 30CWE-347Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-347.

Summary

An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00. An incomplete firmware signature allows a local attacker to upgrade the equipment (kernel, file system) with unsigned, attacker-controlled, data. This occurs because the appliance_config file is signed but the .tar.sec file is unsigned.

Why it matters now

EPSS 0.00273 19th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:belden:tofino_xenon_security_appliance_firmware:*:*:*:*:*:*:*:*up to 3.1.0VulnerableBelden
cpe:2.3:h:belden:tofino_xenon_security_appliance:-:*:*:*:*:*:*:*not specified by NVDRunning onBelden
  • cpe:2.3:o:belden:tofino_xenon_security_appliance_firmware:*:*:*:*:*:*:*:* Versions up to 3.1.0 Vulnerable ·Belden
  • cpe:2.3:h:belden:tofino_xenon_security_appliance:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-11400
  2. 2026-10-03 Alias added: GHSA-mrc4-5458-65m9

References

Advisory 2

  • TI-2017-08429 An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance… CVSS 3.0CRITICAL 9.8
  • TI-2017-08428 An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance… CVSS 3.0CRITICAL 9.8
  • TI-2021-10646 On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23… CVSS 3.1CRITICAL 9.8
  • TI-2021-10647 On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23… CVSS 3.1HIGH 7.5
  • TI-2021-10645 On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino… CVSS 3.1HIGH 7.5
  • TI-2021-10644 On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino… CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences