CVE-2017-18370: OS Command Injection
The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is only accessible by an authenticated user. The vulnerability is in the logSet.asp page and can be exploited through the ServerIP parameter. Authentication can be achieved by exploiting CVE-2017-18371.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-18370?
CVE-2017-18370 is a command injection vulnerability in the ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline.
How severe is CVE-2017-18370?
CVE-2017-18370 has a severity rating of 8.8, which is considered critical.
Which software versions are affected by CVE-2017-18370?
The Zyxel P660HN-T1A Routers with firmware versions 7.3.8.0 and 7.3.37.6 are affected by CVE-2017-18370.
How can the command injection vulnerability in CVE-2017-18370 be exploited?
The command injection vulnerability in CVE-2017-18370 can be exploited through the logSet.asp page in the Remote System Log forwarding function, which is only accessible by an authenticated user.
Are other routers or firmware versions vulnerable to CVE-2017-18370?
No, the Billion 5200W-T and ZyXEL P660HN-T1A v1 routers, as well as other firmware versions, are not vulnerable to CVE-2017-18370.