CVE-2017-17411

9.8 criticalEPSS 88%

Critical (9.8) in linksys wvbr0 firmware. EPSS 88% chance of exploitation in the next 30 days.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data before executing a system call. An attacker could leverage this vulnerability to execute code with root privileges. Was ZDI-CAN-4892.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 88% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2017-12-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

linksys:wvbr0_firmware

References

http://www.securityfocus.com/bid/102212
https://github.com/rapid7/metasploit-framework/pull/9336
https://www.exploit-db.com/exploits/43363/
https://www.exploit-db.com/exploits/43429/
https://zerodayinitiative.com/advisories/ZDI-17-973

Check your stack JSON