CVE-2017-17974

9.8 criticalEPSS 1.7%

Critical (9.8) in basystems. EPSS 1.7% chance of exploitation in the next 30 days.

BA SYSTEMS BAS Web on BAS920 devices (with Firmware 01.01.00*, HTTPserv 00002, and Script 02.*) and ISC2000 devices allows remote attackers to obtain sensitive information via a request for isc/get_sid_js.aspx or isc/get_sid.aspx, as demonstrated by obtaining administrative access by subsequently using the credential information for the Supervisor/Administrator account.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
Published: 2017-12-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

basystems:bas920_firmware
basystems:isc2000_firmware

References

http://misteralfa-hack.blogspot.cl/2017/12/ba-system-improper-access-control.html
https://github.com/ezelf/baCK_system
http://misteralfa-hack.blogspot.cl/2017/12/ba-system-improper-access-control.html
https://github.com/ezelf/baCK_system

Check your stack JSON