{"id":"CVE-2017-18368","published":"2019-05-02T17:29:00Z","modified":"2026-06-17T01:12:42Z","title":"Zyxel P660HN-T1A Routers Command Injection Vulnerability","vendor":"Zyxel","product":"P660HN-T1A Routers","tier":"core","eol":null,"description":{"text":"The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.","provenance":"source","from":"NVD"},"summary":{"text":"The Zyxel P660HN-T1A router (v1, TCLinux firmware distributed by TrueOnline) contains a command injection flaw in its Remote System Log forwarding function, specifically in the ViewLog.asp page via the remote_host parameter. An unauthenticated attacker with network access to the device can inject operating system commands through that parameter, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:41Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.94508,"percentile":0.99853,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2023-08-07","dueDate":"2023-08-28","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-a-new-variant-of-gafgyt-malware; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-p660hn-t1a-dsl-cpe; https://nvd.nist.gov/vuln/detail/CVE-2017-18368","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-11-11","exploitedFirstSeen":"2021-11-11","ransomware":false,"evidence":[{"url":"https://cybersecurity.att.com/blogs/labs-research/att-alien-labs-finds-new-golang-malwarebotenago-targeting-millions-of-routers-and-iot-devices-with-more-than-30-exploits","date":"2021-11-11"},{"url":"https://cujo.com/blog/iot-botnet-report-2021-malware-and-vulnerabilities-targeted/","date":"2021-12-17"},{"url":"https://blog.apnic.net/2021/12/23/preparing-for-the-next-large-scale-iot-botnet-attack/","date":"2021-12-23"},{"url":"https://cybersecurity.att.com/blogs/labs-research/botenago-strike-again-malware-source-code-uploaded-to-github","date":"2022-01-26"},{"url":"https://www.fortiguard.com/threat-signal-report/4389/botenago-malware-targets-multiple-iot-devices","date":"2022-01-27"},{"url":"https://www.fortinet.com/blog/threat-research/enemybot-a-look-into-keksecs-latest-ddos-botnet","date":"2022-04-12"},{"url":"https://cybersecurity.att.com/blogs/labs-research/rapidly-evolving-iot-malware-enemybot-now-targeting-content-management-system-servers","date":"2022-05-26"},{"url":"https://www.welivesecurity.com/wp-content/uploads/2022/10/eset_threat_report_t22022.pdf","date":"2022-10-05"},{"url":"https://www.cs.ucr.edu/~adava003/MalNet_IMC2022.pdf","date":"2022-10-27"},{"url":"https://www.welivesecurity.com/wp-content/uploads/2023/02/eset_threat_report_t32022.pdf","date":"2023-02-08"}],"evidenceTotal":1089,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"http://www.zyxel.com/support/announcement_unauthenticated.shtml","tags":["Broken Link"]},{"url":"https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt","tags":["Exploit","Third Party Advisory"]},{"url":"https://seclists.org/fulldisclosure/2017/Jan/40","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://ssd-disclosure.com/index.php/archives/2910","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/","tags":["Technical Description","Third Party Advisory"]},{"url":"http://www.zyxel.com/support/announcement_unauthenticated.shtml","tags":["Broken Link"]},{"url":"https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt","tags":["Exploit","Third Party Advisory"]},{"url":"https://seclists.org/fulldisclosure/2017/Jan/40","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://ssd-disclosure.com/index.php/archives/2910","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/","tags":["Technical Description","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-18368","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote exploit of exposed web interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"can be exploited through the remote_host parameter","start":281,"end":331}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: injected OS commands execute on the device","mappingType":"primary_impact","evidence":[{"from":"description","quote":"command injection vulnerability in the Remote System Log forwarding function","start":106,"end":182}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-ab60e18dfb72c1e085c0","title":"Matrix Unleashes A New Widespread DDoS Campaign","publisher":"aquasec.com","url":"https://www.aquasec.com/blog/matrix-unleashes-a-new-widespread-ddos-campaign/","date":"2024-11-26","mentions":[{"quote":"Router Vulnerabilities: Attacks on routers, including ZTE and GPON models, exploit vulnerabilities such as CVE-2017-18368, a command injection flaw, and CVE-2021-20090, which affects various devices running Arcadyan firmware.","start":3779,"end":4004},{"quote":"However, the majority of the vulnerabilities center around IoT devices (CVE-2022-30525, CVE-2022-30075, CVE-2018-10562, CVE-2018-10561, CVE-2018-9995, CVE-2017-18368, CVE-2017-17215, CVE-2017-17106, and CVE-2014-8361).","start":7138,"end":7356},{"quote":"CVE-2017-18368: Involves a command injection vulnerability in ZTE routers, where attackers can exploit endpoints similar to those shown above, using them to inject malicious commands and gain control over the device.","start":30841,"end":31057}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-9484","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-9484","exploited":true,"exploitedSince":"2023-08-07","provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"TrueOnline / ZyXEL P660HN-T v1 Router Unauthenticated Command Injection","module":"exploit/linux/http/trueonline_p660hn_v1_rce","type":"exploit","disclosureDate":"2016-12-26","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/trueonline_p660hn_v1_rce.rb"}],"first":{"date":"2016-12-26","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/trueonline_p660hn_v1_rce.rb"},"provenance":"source"},"exploitRefs":["https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt","https://seclists.org/fulldisclosure/2017/Jan/40","https://ssd-disclosure.com/index.php/archives/2910"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2016-12-26","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/trueonline_p660hn_v1_rce.rb","provenance":"source"},{"date":"2019-05-02","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18368","provenance":"source"},{"date":"2021-11-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cybersecurity.att.com/blogs/labs-research/att-alien-labs-finds-new-golang-malwarebotenago-targeting-millions-of-routers-and-iot-devices-with-more-than-30-exploits","provenance":"source"},{"date":"2023-08-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-08-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-9484","provenance":"source"},{"date":"2024-11-26","kind":"report","label":"Named in aquasec.com: Matrix Unleashes A New Widespread DDoS Campaign","url":"https://www.aquasec.com/blog/matrix-unleashes-a-new-widespread-ddos-campaign/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":1558},"priority":{"score":73.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1815 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9985"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}