CVE-2017-17428: Cavium Nitrox SSL SDK

Medium severity, CVSS 5.9. EPSS: 14.6% chance of exploitation in the next 30 days.

Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.

Affected products

• Cavium Nitrox SSL SDK: up to and including 6.1.0
• Cavium Nitrox V SSL SDK: up to and including 1.2
• Cavium Octeon SDK: up to and including 1.7.2
• Cavium Octeon SSL SDK: up to and including 1.5.0
• Cavium Turbossl SDK: up to and including 1.0
• Cisco ACE30 Application Control Engine Module Firmware: version 3.0(0)a5(2.0) only; version 3.0(0)a5(3.0) only; version 3.0(0)a5(3.5) only
• Cisco ACE4710 Application Control Engine Firmware: version 3.0(0)a5(2.0) only; version 3.0(0)a5(3.0) only; version 3.0(0)a5(3.5) only
• Cisco Adaptive Security Appliance 5505 Firmware: version 9.1(7.16) only
• Cisco Adaptive Security Appliance 5510 Firmware: version 9.1(7.16) only
• Cisco Adaptive Security Appliance 5520 Firmware: version 9.1(7.16) only
• Cisco Adaptive Security Appliance 5540 Firmware: version 9.1(7.16) only
• Cisco Adaptive Security Appliance 5550 Firmware: version 9.1(7.16) only
• Cisco Webex Conect Im: version 7.24.1 only
• Cisco Webex Meetings: version t31 only; version t32 only

Published 2018-03-05. Last modified 2026-06-17.