VULNERABILITY INTELLIGENCE
CVE-2017-18001
CVSS score9.8 CRITICAL
EPSS probability14.08%
CISA KEVNot currently listed
Published2017-12-31
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI.
Weakness classification
- CWE-306: Missing Authentication for Critical Function
Primary references
- cve@mitre.org — Exploit, Mailing List, Third Party Advisory
- cve@mitre.org — Exploit, Third Party Advisory
- cve@mitre.org
- cve@mitre.org — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory