CVEvulnerability
CVE-2017-18370
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-05-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-78
Description
The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is only accessible by an authenticated user. The vulnerability is in the logSet.asp page and can be exploited through the ServerIP parameter. Authentication can be achieved by exploiting CVE-2017-18371.
Affected configurations
• billion 5200w-t firmware 7.3.8.0
• zyxel p660hn-t1a v2 firmware 7.3.37.6
• zyxel p660hn-t1a v1 firmware 7.3.37.6
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- http://www.zyxel.com/support/announcement_unauthenticated.shtml Broken Link
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt Exploit, Third Party Advisory
- https://seclists.org/fulldisclosure/2017/Jan/40 Exploit, Mailing List, Third Party Advisory
- https://ssd-disclosure.com/index.php/archives/2910 Exploit, Technical Description, Third Party Advisory
- https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/ Technical Description, Third Party Advisory
- http://www.zyxel.com/support/announcement_unauthenticated.shtml Broken Link
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt Exploit, Third Party Advisory
- https://seclists.org/fulldisclosure/2017/Jan/40 Exploit, Mailing List, Third Party Advisory
- https://ssd-disclosure.com/index.php/archives/2910 Exploit, Technical Description, Third Party Advisory
- https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/ Technical Description, Third Party Advisory