Sign-up

ID

VAR-201811-0016


CVE

CVE-2017-17550


TITLE

ZyXEL ZyWALL USG Device cross-site request forgery vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-014322

DESCRIPTION

ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could, for example, subsequently be used for stored XSS. ZyXEL ZyWALL USG The device contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ZyXEL ZyWALL USG is a network security firewall device of ZyXEL Technology Company. Cross-site request forgery vulnerabilities exist in ZyXEL ZyWALL USG version 2.12 AQQ.2 and version 3.30 AQQ.7. Remote attackers can use the 'cmd' parameter to exploit this vulnerability to add user accounts and implement cross-site scripting attacks

Trust: 1.71

sources: NVD: CVE-2017-17550 // JVNDB: JVNDB-2017-014322 // VULHUB: VHN-108584

AFFECTED PRODUCTS

vendor:zyxelmodel:zywall usg 100scope:eqversion:2.12\(aqq.2\)

Trust: 1.6

vendor:zyxelmodel:zywall usg 100scope:eqversion:3.30\(aqq.7\)

Trust: 1.6

vendor:zyxelmodel:zywall usg 100scope:eqversion:2.12 aqq.2

Trust: 0.8

vendor:zyxelmodel:zywall usg 100scope:eqversion:3.30 aqq.7

Trust: 0.8

sources: JVNDB: JVNDB-2017-014322 // CNNVD: CNNVD-201712-449 // NVD: CVE-2017-17550

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-17550
value: HIGH

Trust: 1.0

NVD: CVE-2017-17550
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201712-449
value: MEDIUM

Trust: 0.6

VULHUB: VHN-108584
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-17550
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-108584
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-17550
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-108584 // JVNDB: JVNDB-2017-014322 // CNNVD: CNNVD-201712-449 // NVD: CVE-2017-17550

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.9

sources: VULHUB: VHN-108584 // JVNDB: JVNDB-2017-014322 // NVD: CVE-2017-17550

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201712-449

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201712-449

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-014322

PATCH
title:Top Pageurl:https://www.zyxel.com/homepage.shtml
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2017-014322

EXTERNAL IDS
db:NVDid:CVE-2017-17550
Trust: 2.5
db:JVNDBid:JVNDB-2017-014322
Trust: 0.8
db:CNNVDid:CNNVD-201712-449
Trust: 0.7
db:VULHUBid:VHN-108584
Trust: 0.1
sources:
            
            
            VULHUB: VHN-108584 // 
            
            
            
            JVNDB: JVNDB-2017-014322 // 
            
            
            
            CNNVD: CNNVD-201712-449 // 
            
            
            
            NVD: CVE-2017-17550

REFERENCES
url:https://www.shellcode.it/article/cve-2017-17550/
Trust: 2.5
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17550
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-17550
Trust: 0.8
sources:
            
            
            VULHUB: VHN-108584 // 
            
            
            
            JVNDB: JVNDB-2017-014322 // 
            
            
            
            CNNVD: CNNVD-201712-449 // 
            
            
            
            NVD: CVE-2017-17550

SOURCES
db:VULHUBid:VHN-108584
db:JVNDBid:JVNDB-2017-014322
db:CNNVDid:CNNVD-201712-449
db:NVDid:CVE-2017-17550

LAST UPDATE DATE
2024-11-23T22:58:49.827000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-108584date:2018-12-13T00:00:00
db:JVNDBid:JVNDB-2017-014322date:2019-01-24T00:00:00
db:CNNVDid:CNNVD-201712-449date:2018-11-12T00:00:00
db:NVDid:CVE-2017-17550date:2024-11-21T03:18:08.590

SOURCES RELEASE DATE
db:VULHUBid:VHN-108584date:2018-11-10T00:00:00
db:JVNDBid:JVNDB-2017-014322date:2019-01-24T00:00:00
db:CNNVDid:CNNVD-201712-449date:2017-12-12T00:00:00
db:NVDid:CVE-2017-17550date:2018-11-10T22:29:00.247