CVE-2017-18370 in the critical feed json
The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Lo…
published 2019-05-02 7 y ago modified 2026-06-17 4 mo ago also EUVD-2017-9486
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 24.4%
- EPSS 24.4% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Metasploit
Summary
The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is only accessible by an authenticated user. The vulnerability is in the logSet.asp page and can be exploited through the ServerIP parameter. Authentication can be achieved by exploiting CVE-2017-18371.
Timeline
- First public exploit (Metasploit exploit/linux/http/trueonline_p660hn_v2_rce)
- Published
Exploit prediction
24.42% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/linux/http/trueonline_p660hn_v2_rce TrueOnline / ZyXEL P660HN-T v2 Router Authenticated Command Injection metasploit exploit, excellent rank, 2016-12-26
- seclists.org https://seclists.org/fulldisclosure/2017/Jan/40 referenced PoC, tagged "exploit" by a source, unverified
- ssd-disclosure.com https://ssd-disclosure.com/index.php/archives/2910 referenced PoC, tagged "exploit" by a source, unverified
- raw.githubusercontent.com https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
seclists.org
/fulldisclosure/2017/Jan/40
exploit, mailing-list, third-party-advisory
-
ssd-disclosure.com
/index.php/archives/2910
exploit, technical-description, third-party-advisory
-
raw.githubusercontent.com
/pedrib/PoC/master/advisories/zyxel_trueonline.txt
exploit, third-party-advisory
-
unit42.paloaltonetworks.com
/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/
technical-description, third-party-advisory
-
zyxel.com
/support/announcement_unauthenticated.shtml
broken-link
Sources
- CVE List CVE-2017-18370
- NVD CVE-2017-18370
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.