CVEvulnerability
CVE-2017-7237
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-04-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks data\configurations directory by leveraging the unauthenticated nature of the TFTP service for all clients who can reach UDP port 69, as demonstrated by a WRQ (aka Write request) operation for a configuration file or an executable file.
Affected configurations
• spiceworks spiceworks 7.5
References
- http://hyp3rlinx.altervista.org/advisories/SPICEWORKS-IMPROPER-ACCESS-CONTROL-FILE-OVERWRITE.txt Exploit, Third Party Advisory
- https://community.spiceworks.com/support/inventory/docs/network-config#security Vendor Advisory
- https://www.exploit-db.com/exploits/41825/ Exploit, Third Party Advisory, VDB Entry
- http://hyp3rlinx.altervista.org/advisories/SPICEWORKS-IMPROPER-ACCESS-CONTROL-FILE-OVERWRITE.txt Exploit, Third Party Advisory
- https://community.spiceworks.com/support/inventory/docs/network-config#security Vendor Advisory
- https://www.exploit-db.com/exploits/41825/ Exploit, Third Party Advisory, VDB Entry