PT-2019-8304 · Billion · Billion 5200W-T

Pedro Ribeiro · Published 2019-05-02 · Updated 2025-10-14 · CVE-2017-18369

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Billion 5200W-T version 1.02b.rc5.dt49

Description The issue is related to a command injection vulnerability in the Remote System Log forwarding function. This function is accessible to unauthenticated users and is located in the adv remotelog.asp page. The vulnerability can be exploited through the syslogServerAddr parameter.

Recommendations For version 1.02b.rc5.dt49, as a temporary workaround, consider restricting access to the adv remotelog.asp page until a patch is available. Avoid using the syslogServerAddr parameter in the affected page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-18369

Affected Products

Billion 5200W-T

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/trueonline_billion_5200w_rce.rb · Exploit
• 🔥 https://ssd-disclosure.com/index.php/archives/2910 · Exploit
• 🔥 https://seclists.org/fulldisclosure/2017/Jan/40 · Exploit
• 🔥 https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-18369 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18369 · Vendor Advisory
• https://t.me/aptreports/22814 · Telegram Post