CVE-2017-18372: OS Command Injection
The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which is only accessible by an authenticated user. The vulnerability is in the toolstime.asp page and can be exploited through the uiViewSNTPServer parameter. Authentication can be achieved by exploiting CVE-2017-18373.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-18372?
CVE-2017-18372 is a command injection vulnerability in the Billion 5200W-T TCLinux router firmware.
How severe is CVE-2017-18372?
CVE-2017-18372 has a severity rating of 8.8 (critical).
Which routers are affected by CVE-2017-18372?
The Billion 5200W-T TCLinux router with firmware version 7.3.8.0 is affected.
How can CVE-2017-18372 be exploited?
CVE-2017-18372 can be exploited through the Time Setting function in the tools_time.asp page.
Are Zyxel P660HN-T1A routers vulnerable to CVE-2017-18372?
Zyxel P660HN-T1A routers with firmware versions 7.3.15.0 are not affected.