CVE-2017-16249

EPSS 59.4%

Vexday Risk Score

50Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 59.4%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Ciclo de vida

02 nov 2017Exploit Metasploit disponible

02 nov 2017PoC pública

09 nov 2017Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST request can cause the server to hang until eventually replying (~300 seconds) with an HTTP 500 error. While the server is hung, print jobs over the network are blocked and the web interface is inaccessible. An attacker can continuously send this malformed request to keep the device inaccessible to legitimate traffic.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 3

cve_referencepacketstormsecurity.com/files/144908/Debut-Embedded-httpd-1.20-Denial-Of-Service.htmlno verificado cve_referencewww.exploit-db.com/exploits/43119/no verificado exploitdbwww.exploit-db.com/exploits/43119no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

http://packetstormsecurity.com/files/144908/Debut-Embedded-httpd-1.20-Denial-Of-Service.html https://www.exploit-db.com/exploits/43119/https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-017/?fid=10211 https://www.trustwave.com/Resources/SpiderLabs-Blog/Denial-of-Service-Vulnerability-in-Brother-Printers/?page=1&year=0&month=0&LangType=1033