CVE-2017-15361

Key facts

CVSS score

5.9 (v3.0)

Severity

MEDIUM

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS score

9.8% (95th percentile)

In CISA KEV

No

In EU EUVD

Yes (EUVD-2017-6817)

Published

October 16, 2017

NVD last modified

June 17, 2026

Status

Modified

Affected products

• acer / c720 chromebook
• acer / chromebase
• acer / chromebase 24
• acer / chromebook 11 c730
• acer / chromebook 11 c730e
• acer / chromebook 11 c735
• acer / chromebook 11 c740
• acer / chromebook 11 c771
• acer / chromebook 11 c771t
• acer / chromebook 11 n7 c731
• acer / chromebook 13 cb5-311
• acer / chromebook 14 cb3-431
• acer / chromebook 14 for work cp5-471
• acer / chromebook 15 cb3-531
• acer / chromebook 15 cb3-532
• acer / chromebook 15 cb5-571
• acer / chromebook r11
• acer / chromebook r13 cb5-312t
• acer / chromebox
• acer / chromebox cxi2
• aopen / chromebase
• aopen / chromebase
• aopen / chromebox
• aopen / chromeboxi
• asi / chromebook
• asus / chromebit cs10
• asus / chromebook c200
• asus / chromebook c201pa
• asus / chromebook c202sa
• asus / chromebook c300
• asus / chromebook c300sa
• asus / chromebook c301sa
• asus / chromebook flip c100pa
• asus / chromebook flip c302
• asus / chromebox cn60
• asus / chromebox cn62
• bobicus / chromebook 11
• ctl / j2 chromebook
• ctl / j4 chromebook
• ctl / j5 chromebook
• ctl / n6 chromebook
• ctl / nl61 chromebook
• dell / chromebook 11
• dell / chromebook 11 3120
• dell / chromebook 11 3189
• dell / chromebook 11 model 3180
• dell / chromebook 13 3380
• dell / chromebox
• edugear / chromebook k
• edugear / chromebook m

and 81 more…

Certified products that may be affected

17 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

• Infineon Security Controller M7892 B11 with optional RSA2048/4096 v1.02.013 or v2.07.003 or v2.09.002, EC v1.02.013 or v2.07.003 or v2.09.002, SHA-2 v1.01, SCL v2.02.012, Base v1.02.013 or v2.07.003 or v2.09.002, and Toolbox v1.02.013 or v2.07.003 or v2.09.002 libraries and with specific IC dedicated software (firmware) - Infineon Technologies AG - Common Criteria BSI-DSZ-CC-0782-V6-2024 - archived
• Infineon Security Controller M7892 B11 with optional RSA2048/4096 v1.02.013 or v2.07.003, EC v1.02.013 or v2.07.003, SHA-2 v1.01, SCL v2.02.012, Base v1.02.013 or v2.07.003, and Toolbox v1.02.013 or v2.07.003 libraries and with specific IC dedicated software (firmware) - Infineon Technologies AG - Common Criteria BSI-DSZ-CC-0782-V5-2020 - archived
• Infineon Technologies Security Controller M7794 A12 / G12 with optional RSA2048/4096v1.02.013 or v2.00.002, EC v1.02.013 or v2.00.002 and Toolbox v1.02.013 or v2.00.002 libraries and with specific IC-dedicated software - Infineon Technologies AG - Common Criteria BSI-DSZ-CC-0964-V4-2019 - archived
• Infineon Security Controller M7892 B11 with optional RSA2048/4096 v1.02.013 or v2.07.003, EC v1.02.013 or v2.07.003, SHA-2 v1.01, SCL v2.02.012, Base v1.02.013 or v2.07.003, and Toolbox v1.02.013 or v2.07.003 libraries and with specific IC dedicated software (firmware) - Infineon Technologies AG - Common Criteria BSI-DSZ-CC-0782-V4-2018 - archived
• Infineon Technologies Security Controller M7794 A12 / G12 with optional RSA2048/4096 v1.02.013 or v2.00.002, EC v1.02.013 or v2.00.002 and Toolbox v1.02.013 or v2.00.002 libraries and with specific IC-dedicated software - Infineon Technologies AG - Common Criteria BSI-DSZ-CC-0964-V3-2017 - archived

See all 17 in the Security Certifications Explorer.

References

• http://support.lenovo.com/us/en/product_security/LEN-15552(Mitigation, Third Party Advisory)
• http://www.securityfocus.com/bid/101484(Third Party Advisory, VDB Entry)
• https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/(Issue Tracking, Third Party Advisory)
• https://blog.cr.yp.to/20171105-infineon.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-470231.pdf
• https://crocs.fi.muni.cz/public/papers/rsa_ccs17(Issue Tracking, Mitigation, Third Party Advisory)
• https://dan.enigmabridge.com/roca-vulnerability-impact-on-gemalto-idprime-net-smart-cards/(Issue Tracking, Third Party Advisory)
• https://github.com/crocs-muni/roca(Mitigation, Third Party Advisory)
• https://github.com/iadgov/Detect-CVE-2017-15361-TPM(Mitigation, Third Party Advisory)
• https://ics-cert.us-cert.gov/advisories/ICSA-18-058-01
• https://keychest.net/roca(Issue Tracking, Mitigation, Third Party Advisory)
• https://monitor.certipath.com/rsatest(Mitigation, Third Party Advisory)
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV170012(Issue Tracking, Patch, Third Party Advisory)
• https://security.netapp.com/advisory/ntap-20171024-0001/
• https://sites.google.com/a/chromium.org/dev/chromium-os/tpm_firmware_update(Issue Tracking, Mitigation, Patch, Third Party Advisory)
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03789en_us
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03801en_us
• https://www.infineon.com/cms/en/product/promopages/tpm-update/?redirId=59160(Mitigation, Vendor Advisory)
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00104.html
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00148.html
• https://www.kb.cert.org/vuls/id/307015(Issue Tracking, Mitigation, Third Party Advisory, US Government Resource)
• https://www.yubico.com/support/security-advisories/ysa-2017-01/(Mitigation, Third Party Advisory)