CVE-2017-6445: Openelec

High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days.

The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A man-in-the-middle attacker could manipulate the update packages to gain root access remotely.

Affected products

• Openelec Openelec: version 6.0.3 only; version 7.0.1 only

Published 2017-03-05. Last modified 2026-06-17.