Path Traversal in Hoytech Antiweb
CVE-2017-9097
In Anti-Web through 3.8.7, as used on NetBiter FGW200 devices through 3.21.2, WS100 devices through 3.30.5, EC150 devices through 1.40.0, WS200 devices through 3.30.4, EC250 devices through 1.40.0, and other products, an LFI vulnerability allows a remote attacker to read or modify files through a path traversal technique, as demonstrated by reading the password file, or using the template parameter to cgi-bin/write.cgi to write to an arbitrary file.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.037 (88.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Hoytech Antiweb — versions 3.0.7, 3.3.5, 3.6.1
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Mailing List, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Patch, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-9097?
- CVE-2017-9097 is a critical-severity vulnerability in Hoytech Antiweb, classified under Path Traversal. CVSS score: 9.1/10. Published 2017-06-16.
- How severe is CVE-2017-9097?
- Critical severity. CVSS v3 base score is 9.1 out of 10.
- Is CVE-2017-9097 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.