Vulnerability Details : CVE-2017-18368
Public exploit exists!
The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.
CVE-2017-18368 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Zyxel P660HN-T1A Routers Command Injection Vulnerability
CISA required action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA description:
Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.
Notes:
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-a-new-variant-of-gafgyt-malware; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-p660hn-t1a-dsl-cpe; https://nvd.nist.gov/vuln/detail/CVE
Added on
2023-08-07
Action due date
2023-08-28
Exploit prediction scoring system (EPSS) score for CVE-2017-18368
97.50%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2017-18368
-
TrueOnline / ZyXEL P660HN-T v1 Router Unauthenticated Command Injection
Disclosure Date: 2016-12-26First seen: 2020-04-26exploit/linux/http/trueonline_p660hn_v1_rceTrueOnline is a major ISP in Thailand, and it distributes a customized version of the ZyXEL P660HN-T v1 router. This customized version has an unauthenticated command injection vulnerability in the remote log forwarding page. This module was tested in an emulated env
CVSS scores for CVE-2017-18368
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2017-18368
-
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-18368
-
https://seclists.org/fulldisclosure/2017/Jan/40
Full Disclosure: Multiple RCE in ZyXEL / Billion / TrueOnline routersMailing List;Exploit;Third Party Advisory
-
https://ssd-disclosure.com/index.php/archives/2910
SSD Advisory - ZyXEL / Billion Multiple Vulnerabilities - SSD Secure DisclosureExploit;Technical Description;Third Party Advisory
-
https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/
New Mirai Variant Targets Enterprise Wireless Presentation & Display SystemsTechnical Description;Third Party Advisory
-
http://www.zyxel.com/support/announcement_unauthenticated.shtml
404 Error | ZyxelBroken Link
-
https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt
Exploit;Third Party Advisory
Products affected by CVE-2017-18368
- cpe:2.3:o:zyxel:p660hn-t1a_v2_firmware:7.3.15.0:*:*:*:*:*:*:*
- cpe:2.3:o:zyxel:p660hn-t1a_v1_firmware:7.3.15.0:*:*:*:*:*:*:*
- cpe:2.3:o:billion:5200w-t_firmware:7.3.8.0:*:*:*:*:*:*:*