8.8high
CVE-2017-6884KEV · ransomwarein critical feed1 exploit
A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8.
Published 9 y ago · modified 36 d ago · JSON
CVSS
8.8
v3.1 · CNA
CISA KEV
Yes
added 2023-09-18
EPSS
33.0%
percentile 98%
Public exploits
1
Exploit-DB
Summary
A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
Known exploited (CISA KEV)
- Added
- 3 y ago
- Due date
- 2023-10-09 (3 y ago)
- Ransomware use
- Known to be used in ransomware campaigns
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Vendor / product
- Zyxel / EMG2926 Routers
- CISA name
- Zyxel EMG2926 Routers Command Injection Vulnerability
CISA SSVC assessment
- Exploitation
- Active — exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 3 mo ago
Exploit prediction (EPSS)
32.98% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.
Exploits and detections
- EDB-41782 Zyxel_ EMG2926 < V1.00(AAQT.4)b8 - OS Command Injection · webapps · 2017-04-02
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Classification
- Weakness
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
- exploit-db.com /exploits/41782/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6884 · government-resource
Sources
- CVE List: CVE-2017-6884
- NVD: CVE-2017-6884
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.