PT-2017-4255 · Zyxel · Zyxel Emg2926

Trevor Hough · Published 2017-04-06 · Updated 2025-02-04 · CVE-2017-6884

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel EMG2926 version V1.00(AAQT.4)b8

Description A command injection issue was discovered in the diagnostic tools of the Zyxel EMG2926 home router, specifically in the nslookup function. This allows a malicious user to execute arbitrary commands on the router by exploiting various vectors, such as the ping ip parameter to the "expert/maintenance/diagnostic/nslookup" URI.

Recommendations For Zyxel EMG2926 version V1.00(AAQT.4)b8, consider disabling the nslookup function in the diagnostic tools as a temporary workaround until a patch is available. Restrict access to the "expert/maintenance/diagnostic/nslookup" URI to minimize the risk of exploitation. Avoid using the ping ip parameter in the affected URI until the issue is resolved.

Exploit

Fix

OS Command Injection

Special Elements Injection

Improper Neutralization

Weakness Enumeration

CWE-78

CWE-74

CWE-707

Related Identifiers

BDU:2023-06093

CVE-2017-6884

Affected Products

Zyxel Emg2926

References · 15

• 🔥 https://exploit-db.com/exploits/41782 · Exploit
• https://osv.dev/vulnerability/CVE-2017-6884 · Vendor Advisory
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-emg2926-q10a-ethernet-cpe · Security Note
• https://zyxelguard.com/Zyxel-EOL.asp · Security Note
• https://bdu.fstec.ru/vul/2023-06093 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-6884 · Security Note
• https://twitter.com/GreyNoiseIO/status/1703800865914786053 · Twitter Post
• https://vuldb.com/?id.99342 · Note
• https://twitter.com/synfinner/status/1703856165539512788 · Twitter Post
• https://t.me/cvenotify/109692 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6884 · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://twitter.com/KevDataBase/status/1703807204728471732 · Twitter Post
• https://t.me/cvenotify/109871 · Telegram Post
• https://twitter.com/foxbook/status/1703902525156659573 · Twitter Post