CVE-2017-6884
Zyxel EMG2926 Routers Command Injection Vulnerability
Description
CVE-2017-6884 is a command injection vulnerability in the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability exists in the diagnostic tools of the router's web interface, specifically in the nslookup function, where the ping_ip parameter is not properly sanitized. An authenticated attacker can exploit this command injection flaw to execute arbitrary commands on the router, potentially gaining full control of the device. CISA has confirmed active exploitation of CVE-2017-6884, including use in ransomware campaigns, and the EPSS score of 91.5% places it in the 99th percentile for exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zyxel | emg2926 firmware | v1.00\(aaqt.4\)b8 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.exploit-db.com/exploits/41782/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6884(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
The Zyxel EMG2926 router fails to properly neutralize special characters in user-supplied input to the nslookup diagnostic function. This allows an authenticated user to inject operating system commands through the ping_ip parameter, which are then executed by the underlying system with the privileges of the router's web service.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2017-6884 carries a CVSS v3.1 score of 8.8 (High), reflecting its significant exploitability. The vulnerability is remotely exploitable without physical access over the network, is easy to exploit with no special conditions needed, and requires no user interaction — though it does require low-level authentication (such as a standard user account on the router). Confidentiality (High): An attacker who achieves command execution can access all data stored on or passing through the router, including network credentials and traffic. Integrity (High): Full command execution allows modification of router configuration, firmware, and DNS settings. Availability (High): The compromised router can be rendered inoperable or recruited into a botnet. Critically, CISA has confirmed that this vulnerability has been used in ransomware campaigns, amplifying the business risk for organizations using affected devices. With an EPSS score of 91.5%, active exploitation is near-certain.
Exploit Maturity
Public exploit code is available for CVE-2017-6884 via Exploit Database, providing a proof-of-concept that demonstrates the command injection through the nslookup diagnostic tool. CISA has confirmed active exploitation of this Zyxel EMG2926 vulnerability in the wild, and it has been linked to ransomware operations, making it a high-priority threat. The EPSS score of 91.5% indicates near-certain exploitation activity, placing CVE-2017-6884 in the 99th percentile for exploitation probability.
Remediation
- Apply mitigations per vendor instructions or discontinue use of the Zyxel EMG2926 router if mitigations are unavailable, as directed by CISA (remediation deadline: October 9, 2023). Check Zyxel's support site for firmware updates for the EMG2926 that address this command injection vulnerability.
- Upgrade the EMG2926 firmware beyond version V1.00(AAQT.4)b8 to a patched version if available. If the device has reached end of life, replace it with a currently supported router model.
- Restrict access to the router's management interface by disabling remote administration and limiting access to trusted internal IP addresses only. Implement strong, unique credentials for all router accounts to reduce the risk from the low-privilege authentication requirement.
- Monitor router logs for suspicious diagnostic tool usage, particularly unexpected nslookup requests or commands containing shell metacharacters in the ping_ip parameter. Look for indicators of compromise such as unauthorized configuration changes or unusual outbound connections.
- Implement network segmentation to isolate the router's management interface from untrusted networks. Deploy input validation and command filtering at the network perimeter to detect and block command injection attempts targeting the diagnostic endpoints.
Technical Details
CVE-2017-6884 is a classic OS command injection vulnerability (CWE-78) in the Zyxel EMG2926 router's diagnostic tools. The nslookup function, accessible at the URI expert/maintenance/diagnostic/nslookup, takes user input via the ping_ip parameter and passes it directly to an operating system command without adequate sanitization or escaping of special characters. This allows an authenticated attacker to append arbitrary shell commands using standard injection techniques (such as semicolons, pipe characters, or command substitution). The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates the attack is network-based with low complexity, requires only low-level privileges (a standard router user account), and results in complete compromise of confidentiality, integrity, and availability of the device.
Frequently Asked Questions
Is CVE-2017-6884 being actively exploited?
Yes, CVE-2017-6884 is actively exploited. CISA has added it to the Known Exploited Vulnerabilities catalog, confirming exploitation in the wild. Notably, this vulnerability has been linked to ransomware campaigns, and its EPSS score of 91.5% indicates near-certain exploitation activity.
What products are affected by CVE-2017-6884?
CVE-2017-6884 affects the Zyxel EMG2926 home router running firmware version V1.00(AAQT.4)b8. The command injection vulnerability is specifically in the nslookup diagnostic function accessible through the router's web management interface.
How do I fix CVE-2017-6884?
Update the Zyxel EMG2926 firmware to a patched version if available from Zyxel. If no patch is available or the device has reached end of life, discontinue use and replace it with a supported router. As an immediate mitigation, disable remote management access and restrict the management interface to trusted internal networks only.
How severe is CVE-2017-6884?
CVE-2017-6884 is rated High with a CVSS v3.1 score of 8.8 out of 10. It is in the 99th percentile for exploitation probability with an EPSS score of 91.5%. The confirmed use in ransomware campaigns and the availability of public exploit code make this a high-priority vulnerability requiring immediate action.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.