Zyxel · P660HN-T1A Routers
The Zyxel P660HN-T1A router (v1, TCLinux firmware distributed by TrueOnline) contains a command injection flaw in its Remote System Log forwarding function, specifically in the ViewLog.asp page via the remote_host parameter. An unauthenticated attacker with network access to the device can inject operating system commands through that parameter, with no user interaction or special configuration required.
The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.
First seen exploited 3 years after disclosure. Public exploit code (Metasploit) was available 2 years before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
unauthenticated remote exploit of exposed web interface
can be exploited through the remote_host parameter
injected OS commands execute on the device
command injection vulnerability in the Remote System Log forwarding function
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2017-18368 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Router Vulnerabilities: Attacks on routers, including ZTE and GPON models, exploit vulnerabilities such as CVE-2017-18368, a command injection flaw, and CVE-2021-20090, which affects various devices running Arcadyan firmware.
3 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.