VULNERABILITY INTELLIGENCE
CVE-2017-18368
CVSS score9.8 CRITICAL
EPSS probability94.51%
CISA KEVKnown exploited vulnerability
Published2019-05-02
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Known Exploited Vulnerability
Zyxel P660HN-T1A Routers Command Injection Vulnerability
Vendor / product: Zyxel / P660HN-T1A Routers
Description
The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.
Weakness classification
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Primary references
- cve@mitre.org — Broken Link
- cve@mitre.org — Exploit, Third Party Advisory
- cve@mitre.org — Exploit, Mailing List, Third Party Advisory
- cve@mitre.org — Exploit, Technical Description, Third Party Advisory
- cve@mitre.org — Technical Description, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Technical Description, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Technical Description, Third Party Advisory
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource