{"id":"CVE-2017-18368","kind":"vulnerability","aliases":["CVE-2017-18368"],"related":[],"title":"The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command…","description":"Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Zyxel P660HN-T1A routers have a command injection flaw in the Remote System Log forwarding function, reached through the remote_host parameter of the ViewLog.asp page. An unauthenticated attacker can run commands on the router.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2023-08-07T00:00:00+00:00","products":[{"name":"Zyxel P660HN-T1A Routers","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"billion 5200w-t firmware","fixed":[],"affected":"= 7.3.8.0","ecosystem":"vendor"},{"name":"zyxel p660hn-t1a v2 firmware","fixed":[],"affected":"= 7.3.15.0","ecosystem":"vendor"},{"name":"zyxel p660hn-t1a v1 firmware","fixed":[],"affected":"= 7.3.15.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","p660hn-t1a","routers","self-hosted","zyxel"],"not_affected_if":["no-p660hn-t1a-router"],"how_to_check":null,"fix":"Apply the mitigations per the vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action).","status":"open","published_at":"2019-05-02T17:29:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:50+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:04:50Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations per the vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action).\nunknown","reach":"network","impact":"high","summary":"Zyxel P660HN-T1A routers have a command injection flaw in the Remote System Log forwarding function, reached through the remote_host parameter of the ViewLog.asp page. An unauthenticated attacker can run commands on the router.","category":"infrastructure","who_cares":["zyxel","p660hn-t1a","routers","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthenticated attacker runs arbitrary commands on the router","analyst_note":"Find the Zyxel vendor advisory and the exact firmware versions that are fixed or mitigations for P660HN-T1A, plus a way to check the remote_host setting on ViewLog.asp; see https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-18368","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-p660hn-t1a-router"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000506,"input_tokens":2859,"output_tokens":441,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-18368':23A,26A '-2017':22A,25A '3.40':11A '5200w':34A '5200w-t':33A '7.3.15.0':9A 'access':114C 'action':132C 'appli':133C 'attack':88B 'b31':13A 'billion':32A 'cisa':130C 'command':20A,66B,91B,102C 'contain':100C 'cve':21A,24A 'discontinu':139C 'distribut':15A 'exploit':49B,120C 'firmware':36A,42A,48A 'flaw':68B 'forward':74B,110C 'function':75B,111C 'fw':8A 'host':57B,80B,124C 'infrastructur':50B 'inject':67B,103C 'instruct':137C 'log':73B,109C 'mitig':134C,145C 'p660hn':4A,29A,39A,45A,52B,61B,97C 'p660hn-t1a':3A,28A,38A,44A,51B,60B,96C 'page':85B,129C 'paramet':81B,125C 'per':135C 'product':143C 'reach':76B 'remot':71B,79B,107C,123C 'requir':131C 'router':14A,54B,63B,94B,99C 'routers':31A 'run':90B 'self':56B 'self-host':55B 'system':72B,108C 't':35A 't1a':5A,30A,40A,46A,53B,62B,98C 'tclinux':7A 'trueonlin':17A 'ulm.0':12A 'unauthent':87B,117C 'unavail':147C 'use':140C 'user':118C 'v001':10A 'v1':6A,47A 'v2':41A 'vendor':136C 'via':121C 'viewlog.asp':84B,128C 'vulner':104C 'zyxel':2A,27A,37A,43A,58B,59B,95C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-05-02T17:29:00+00:00","kev":{"dateAdded":"2023-08-07","dueDate":"2023-08-28","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-18368","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-18368","severity":null,"published_at":"2023-08-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-18368","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18368","severity":null,"published_at":"2019-05-02T17:29:00+00:00","modified_at":"2026-06-17T01:12:42+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}