CVE-2017-6884highunder attackransomwareCWE-78

CVE-2017-6884

Published · Updated

83Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.8epss 35%
from disclosure to weapon0 days
Published on NVDApr 6
1st PoCApr 2
CISA KEV+2356d
exploitation probability
35%top 2% of all CVEs
observed exploitation
yesCISA + VulnCheck
2 public exploit(s)
Action required by CISAfederal deadline: 2023-10-09

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A Zyxel home router allows attackers to run arbitrary commands through the diagnostic nslookup tool by injecting malicious input into the ping_ip parameter. This gives attackers complete control over the router.

Technical detail

Command injection vulnerability in Zyxel EMG2926 firmware V1.00(AAQT.4)b8 diagnostic nslookup function allows unauthenticated remote code execution via unsanitized ping_ip parameter in the expert/maintenance/diagnostic/nslookup URI. Attack vector requires network access to the router's web interface; successful exploitation grants arbitrary command execution with router privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/41782unverifiedcve_referencewww.exploit-db.com/exploits/41782/unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6884https://www.exploit-db.com/exploits/41782/