CVE-2017-13696

high-risk
Published 2018-01-24

A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse Enterprise 9.9.16 where an attacker can craft a malicious GET request and exploit the web server component. Successful exploitation of the software will allow an attacker to gain complete access to the system with NT AUTHORITY / SYSTEM level privileges. The vulnerability lies due to improper handling and sanitization of the incoming request.

Do I need to act?

!
63.4% chance of exploitation in next 30 days
EPSS score — higher than 37% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (4)

Diskpulse

Affected Vendors

Flexense

References (10)

Exploit https://www.exploit-db.com/exploits/42557
Exploit https://www.exploit-db.com/exploits/42558/
Exploit https://www.exploit-db.com/exploits/42559/
Exploit https://www.exploit-db.com/exploits/42560/
Third Party Advisory https://www.rapid7.com/db/modules/exploit/windows/http/disk_pulse_enterprise_get
Exploit https://www.exploit-db.com/exploits/42557
Exploit https://www.exploit-db.com/exploits/42558/
Exploit https://www.exploit-db.com/exploits/42559/
Exploit https://www.exploit-db.com/exploits/42560/
Third Party Advisory https://www.rapid7.com/db/modules/exploit/windows/http/disk_pulse_enterprise_get
61
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 19/34 · Moderate
Exposure 10/34 · Low