---
id: "CVE-2017-9248"
kind: "vulnerability"
aliases: ["CVE-2017-9248"]
title: "Progress ASP.NET AJAX and Sitefinity: Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.75098
exploited: true
status: "open"
category: "package"
products: [{"name": "Progress ASP.NET AJAX and Sitefinity", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["asp.net", "exploited", "iis", "package", "sitefinity", "telerik", "windows"]
not_affected_if: ["no-sitefinity", "no-telerik-ui"]
published_at: "2017-07-03T19:29:00+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:29:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-9248", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-9248", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9248", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Progress ASP.NET AJAX and Sitefinity: Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability

Progress Telerik UI for ASP.NET AJAX and Sitefinity contain a cryptographic weakness in Telerik.Web.UI.dll. An attacker can use it to recover encryption keys, run cross-site scripting, tamper with ViewState, and upload or download files.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Progress ASP.NET AJAX and Sitefinity affected ? fixed ?

## How to check

Search deployed web application bins for Telerik.Web.UI.dll and check its version against the vendor advisory; the sources do not give affected version ranges.

## Fix

Apply the vendor update per Progress guidance; the sources do not name a fixed version.
Rotate Telerik.Web.UI.DialogParametersEncryptionKey and the MachineKey after patching.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-9248
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-9248
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-9248

## From the sources

Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_