CVE-2017-7310

EPSS 53.7%

Vexday Risk Score

50Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 53.7%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

29 Mar 2017Metasploit module available

29 Mar 2017Public PoC

29 Mar 2017Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 10.6, DiskSavvy before 10.6, DupScout before 10.6, and VX Search before 10.6 allows attackers to execute arbitrary code via a crafted XML file containing a long name attribute of a classify element.

Affected products

n/a · n/a

public PoCs found — 8

cve_referencewww.exploit-db.com/exploits/41771/unverified cve_referencewww.exploit-db.com/exploits/41772/unverified cve_referencewww.exploit-db.com/exploits/41773/unverified cve_referencewww.exploit-db.com/exploits/43875/unverified cve_referencewww.exploit-db.com/exploits/44157/unverified exploitdbwww.exploit-db.com/exploits/43875unverified exploitdbwww.exploit-db.com/exploits/41773unverified exploitdbwww.exploit-db.com/exploits/44157unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://www.exploit-db.com/exploits/41771/https://www.exploit-db.com/exploits/41772/https://www.exploit-db.com/exploits/41773/https://www.exploit-db.com/exploits/43875/https://www.exploit-db.com/exploits/44157/http://www.diskboss.com/news.html http://www.diskpulse.com/news.html http://www.disksavvy.com/news.html http://www.disksorter.com/news.html http://www.dupscout.com/news.html http://www.securityfocus.com/bid/97237 http://www.syncbreeze.com/news.html