Actively exploited · Published May 2, 2019 · Assigned by mitre
CVE-2017-18368
Critical 9.8 Exploited
In plain English
A critical-severity OS command injection in P660HN-T1A Routers from Zyxel. Attackers are actively exploiting it in the wild (listed by CISA on August 7, 2023). The chance it is exploited in the next 30 days is estimated at 94.5% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 28, 2023.
Official description
The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://seclists.org/fulldisclosure/2017/Jan/40 x_refsource_MISC
- https://ssd-disclosure.com/index.php/archives/2910 x_refsource_MISC
- https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/ x_refsource_MISC
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt x_refsource_MISC
- http://www.zyxel.com/support/announcement_unauthenticated.shtml x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-18368 government-resource