CVE-2017-17411

Status: ModifiedCritical (9.8)—💥 Exploit

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data before executing a system call. An attacker could leverage this vulnerability to execute code with root privileges. Was ZDI-CAN-4892.

CVSS

Version: 3.0
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base score: 9.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 88%
Percentile among all scored CVEs: 100
Score date: 10/6/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

💥 Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Metasploit module (reliable, widely available exploit) · Linksys WVBR0-25 User-Agent Command Execution
Published on Exploit-DB · Linksys WVBR0-25 - User-Agent Command Execution (Metasploit) (1/4/2018)
Published on Exploit-DB · Linksys WVBR0 - 'User-Agent' Remote Command Injection (12/14/2017)

Affected technologies (1)

Linksys — Wvbr0 Firmware

CWEs

CWE-78
CWE-78

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2017-17411",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "zdi-disclosures@trendmicro.com",
      "affectedData": [
        {
          "vendor": "Linksys",
          "product": "Linksys WVBR0",
          "versions": [
            {
              "status": "affected",
              "version": "WVBR0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-12-21T14:29:00.520",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/102212",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    },
    {
      "url": "https://github.com/rapid7/metasploit-framework/pull/9336",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/43363/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/43429/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    },
    {
      "url": "https://zerodayinitiative.com/advisories/ZDI-17-973",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/102212",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/rapid7/metasploit-framework/pull/9336",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/43363/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/43429/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://zerodayinitiative.com/advisories/ZDI-17-973",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "zdi-disclosures@trendmicro.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data before executing a system call. An attacker could leverage this vulnerability to execute code with root privileges. Was ZDI-CAN-4892."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad permite que los atacantes remotos ejecuten código arbitrario en instalaciones vulnerables de Linksys WVBR0. No se requiere autenticación para explotar esta vulnerabilidad. Este error en concreto existe en el portal web de gestión. El problema deriva de la falta de validación correcta de datos de usuario antes de ejecutar una llamada del sistema. Un atacante podría aprovechar esta vulnerabilidad para ejecutar código con privilegios root. Anteriormente era ZDI-CAN-4892."
    }
  ],
  "lastModified": "2026-06-17T01:10:45.330",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linksys:wvbr0_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89C14B79-5C23-4DF4-8607-C5B14DAC75EF",
              "versionEndExcluding": "1.0.41"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:linksys:wvbr0:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B1129E8A-FAF1-4B2D-829C-B01DC003F04C"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "zdi-disclosures@trendmicro.com"
}