CVE-2017-9097
9.1
CRITICAL · CVSS 3.0 · EPSS 3.7% (pctl 90)
In your normal cycle
Critical by CVSS (9.1), but no sign of active exploitation.
Description
In Anti-Web through 3.8.7, as used on NetBiter FGW200 devices through 3.21.2, WS100 devices through 3.30.5, EC150 devices through 1.40.0, WS200 devices through 3.30.4, EC250 devices through 1.40.0, and other products, an LFI vulnerability allows a remote attacker to read or modify files through a path traversal technique, as demonstrated by reading the password file, or using the template parameter to cgi-bin/write.cgi to write to an arbitrary file.
Scoring
| CVSS | 9.1 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| EPSS | 3.73% — more likely to be exploited than 90% of all CVEs |
| Weakness | CWE-22 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2017-06-16 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| hoytech | antiweb |
References
- http://misteralfa-hack.blogspot.cl/2017/05/apps-industrial-ot-over-server-anti-web.html
- https://github.com/ezelf/industrial_Tools/tree/master/scadas_server_antiweb/LFI
- https://www.netbiter.com/docs/default-source/netbiter-english/software/hms-security-advisory-2017-05-24-001-ws100-ws200-ec150-ec250.zip
- http://misteralfa-hack.blogspot.cl/2017/05/apps-industrial-ot-over-server-anti-web.html
- https://github.com/ezelf/industrial_Tools/tree/master/scadas_server_antiweb/LFI
- https://www.netbiter.com/docs/default-source/netbiter-english/software/hms-security-advisory-2017-05-24-001-ws100-ws200-ec150-ec250.zip
→ the Explorer · watch your stack · NVD