CVE-2017-7480

highpriority · track · 40EPSS 0.024 · 84 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

2.37% (84th) EPSS

CVSS 7.5 · high

Is it mine?

2 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-27

rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remote code execution.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-417USprimaryCWE-300US

affected products (2)

Products and version ranges known to be affected.

Red Hat, Inc. rkhunter≤ before 1.4.4enisa_euvdEU
rootkit hunter project rootkit hunter≤ 1.4.2nvdUScpe:2.3:a:rootkit_hunter_project:rootkit_hunter:*:*:*:*:*:*:*:*

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2017-07-21modified 2026-06-17

related (14)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2019-9855US	critical9.8	2.65% (86th)	—	2019-09-06
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launche…
CVE-2017-1000197US	critical9.8	1.21% (68th)	—	2017-11-17
October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server.
CVE-2017-6520US	critical9.1	1.98% (80th)	—	2017-05-01
The Multicast DNS (mDNS) responder used in BOSE Soundtouch 30 inadvertently responds to IPv4 unicast queries with source addresses that are not link-local, which allows remote atta…
CVE-2018-13906US	critical9.1	0.66% (52nd)	—	2019-06-14
The HMAC authenticating the message from QSEE is vulnerable to timing side channel analysis leading to potentially forged application message in Snapdragon Auto, Snapdragon Compute…
CVE-2018-8929US	high8.1OT elevated	0.75% (55th)	—	2018-07-06
Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN Client before 1.2.4-0224 allows remote attackers to conduct man…

+9 more

references (7)

External citations — patches, advisories, analysis.

http://rkhunter.cvs.sourceforge.net/viewvc/rkhunter/rkhunter/files/CHANGELOGPatchcnnvd
http://seclists.org/oss-sec/2017/q2/643 cnnvd
https://security.gentoo.org/glsa/201805-11 cnnvd
http://seclists.org/oss-sec/2017/q2/643 enisa_euvd
https://security.gentoo.org/glsa/201805-11 enisa_euvd
http://seclists.org/oss-sec/2017/q2/643Mailing ListThird Party Advisorynvd
https://security.gentoo.org/glsa/201805-11Third Party Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan