dbcve.org
EluxApplication · Unicon Software

CVE-2017-7977

CRITICAL · 9.8 CVSS v3.1 Published 2017-07-19
Fix available
A fix is available. Upgrade to 5.5.0 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
The Screensavercc component in eLux RP before 5.5.0 allows attackers to bypass intended configuration restrictions and execute arbitrary commands with root privileges by inserting commands in a local configuration dialog in the control panel.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A command injection vulnerability in the Screensavercc component of eLux RP thin client OS allows authenticated local attackers to bypass configuration restrictions by injecting arbitrary shell commands through a local configuration dialog in the control panel, achieving root-level code execution.

MitigationUpgrade eLux RP to version 5.5.0 or later. If immediate patching is not feasible, restrict physical and local access to the control panel configuration dialogs and monitor for unauthorized changes to screensaver settings.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
EluxApplication
Affected:< 5.5.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify eLux RP version
    Check the installed version of eLux RP thin client OS by reviewing system information files, the /etc/elux_version file, or the system control panel about section. On eLux systems, you can typically run 'elux-version' in the terminal or check the system properties in the control panel.
    Affected if The installed version is Unicon Software Elux and is below version 5.5.0 (e.g., 5.4.x, 5.3.x, etc.)
  2. Locate the Screensavercc component
    Check if the Screensavercc component is present on the system by examining the installed software packages or modules list. On eLux RP, this can typically be found in the software package manager or by listing installed RPM packages with 'rpm -qa | grep -i screensaver' or checking the control panel for screensaver settings.
    Affected if The Screensavercc component is installed and appears in the list of installed software packages or modules.
  3. Verify control panel access
    Examine the control panel configuration dialogs accessible to standard users. Attempt to access the screensaver configuration dialog through the system control panel as a non-administrator user to determine if configuration options are available.
    Affected if Authenticated local users (non-administrative) can access and modify screensaver settings through the control panel configuration dialogs.
  4. Inspect screensaver configuration files
    Review the screensaver configuration files stored on the system, typically found in /etc or user configuration directories. Check for any unusual command parameters, unexpected file paths, or suspicious entries in screensaver-related configuration files.
    Affected if Screensaver configuration files contain unusual command parameters, unexpected executable paths, or suspicious shell command injections in settings fields.

The system is affected if it runs Unicon Software Elux (eLux RP) version below 5.5.0 and has the Screensavercc component installed with accessible configuration dialogs.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 5.5.0 or later
Fixed in 5.5.0
Interim mitigation

Upgrade eLux RP to version 5.5.0 or later. If immediate patching is not feasible, restrict physical and local access to the control panel configuration dialogs and monitor for unauthorized changes to screensaver settings.

Recommended fix Moderate confidence

eLux RP 5.5.0

  1. 1. Verify the current eLux RP version by checking system information or running: cat /etc/elux-release
  2. 2. Create a full backup of the current system configuration and any critical data
  3. 3. Obtain eLux RP version 5.5.0 or later from the official vendor (www.myelux.com or through authorized distribution channels)
  4. 4. Follow the vendor's official upgrade procedure for eLux RP, typically using the provided update mechanism or installation media
  5. 5. After upgrade, verify the Screensavercc component is updated and the vulnerability is addressed by confirming version 5.5.0 or later is installed

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Elux Scoped from the published advisory
  • Consultation6.0 h
  • Implementation12.0 h
  • Testing10.0 h
  • Review / QA6.0 h
34.0 hours of engineering $5,940
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $9,504.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2017-7977 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2017-7977 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data