High severity · published Jun 21, 2017
CVE-2017-3218
Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates.
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Magician · Samsung
5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-3218
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-3218
Third Party Advisory
http://www.securityfocus.com/bid/99081
Third Party Advisory
https://www.kb.cert.org/vuls/id/846320
More from Magician
7.8
CVE-2025-57836
An issue was discovered in Samsung Magician 6.3.0 through 8.3.2 on Windows
6.7
CVE-2024-31953
An issue was discovered in Samsung Magician 8.0.0 on macOS
6.7
CVE-2024-31952
An issue was discovered in Samsung Magician 8.0.0 on macOS
6.3
CVE-2024-36071
Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the installation process
5.5
CVE-2024-23769
Improper privilege control for the named pipe in Samsung Magician PC Software 8.0.0 (for Windows) allows a local attacker to read privileged data