Threat operations/Case file
AL
Member accessPublic view · sign in

Vulnerability threat dossier

CVE-2017-17562

embedthisgoahead

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.

VTP deterministic threat62.8of 100 · CVSS excluded

VTP analyst assessment

Monitoring — no AI review currently required

AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateCANDIDATE CREATED
AI priorityHIGH
AI confidenceUnknown
Public exploitation · VTP factKEV

Assessment

This CVE remains in monitoring. Its metadata and source evidence are available below. A new material report or relevant sensor finding can trigger an AI review.

Why it matters

The available facts and source references are listed below. No AI assessment has been recorded for this dossier.

Evidence

No validated baseline evidence scope is persisted for this CVE.

Uncertainties

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

A validated functional exploit or automated exploitation capability would materially change this assessment.

AI baseline history (0)
    Technical severityHIGHCVSS 8.1 · technical context
    Public exploitationKEVGlobal public evidence
    Exploit maturityPOCReliability not implied
    EPSS0.96100th percentile · prediction
    Evidence confidence90%Strongest independent active claim
    VelocitySTABLEMaterial events only
    First-party telemetryFirst-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
    Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN
    01

    VTP deterministic assessment

    Why this matters

    1. 01

      CISA KEV lists this vulnerability as known to be exploited globally.

    2. 02

      A proof of concept is reported; functional reliability is not established.

    3. 03

      EPSS is 0.96; this is predictive context, not exploitation evidence.

    4. 04

      First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

    02

    Material change ledger

    What changed

    EXPLOIT TEMPLATE AVAILABLEPublic exploit-oriented template available
    KEV ADDEDCISA KEV entry added
    03

    Claim provenance

    Evidence and source independence

    1publications detected
    1underlying evidence chains

    0 primary sources · 0 dependent secondary reports · 0 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

    Source claimEXPLOIT TEMPLATE AVAILABLEPUBLIC EXPLOIT TEMPLATE
    90%claim confidence
    PRIMARYcorpus:OPENVAS_NASL:5999664b9a4b3602d7ad4f674ca76f315d15fbd1ACTIVE
    04

    Event history

    Threat timeline

    1. 02:3623 Sept
      EXPLOIT TEMPLATE AVAILABLE

      Public exploit-oriented template available

      Greenbone Community Feed published new or materially changed exploit-oriented tooling for this CVE. This is availability evidence, not evidence of exploitation in the wild.

    2. 00:0010 Dec
      KEV ADDED

      CISA KEV entry added

      CISA lists global known exploitation. This is not a VTP sensor observation.

    05

    Original publications

    Source record

    Greenbone Community FeedEXPLOIT INTELLIGENCEPRIMARY

    Exploit tooling coverage changed for 69 CVEs

    Greenbone Community Feed recorded exploit-tooling coverage changes for 69 CVEs in this pinned revision. 69 have an active availability assertion for this revision. Tooling evidence does not establish exploitation in the wild or successful execution.

    CVE-2016-0792CVE-2016-0870CVE-2016-10107CVE-2016-10108CVE-2016-10140CVE-2016-10401CVE-2016-2107CVE-2016-5649CVE-2016-8346CVE-2016-8722CVE-2016-8724CVE-2016-8725CVE-2016-9361CVE-2017-1000060CVE-2017-10931CVE-2017-14247CVE-2017-14252CVE-2017-14401CVE-2017-14402CVE-2017-14403CVE-2017-14404CVE-2017-14405CVE-2017-14942CVE-2017-17562CVE-2017-18365CVE-2017-20212CVE-2017-20213CVE-2017-20214CVE-2017-20215CVE-2017-20216CVE-2017-20221CVE-2017-20222CVE-2017-20223CVE-2017-20224CVE-2017-3143CVE-2017-3549CVE-2017-3599CVE-2017-5135CVE-2017-5367CVE-2017-5368CVE-2017-5521CVE-2017-5595CVE-2017-5689CVE-2017-5879CVE-2017-5982CVE-2017-6099CVE-2017-7315CVE-2017-7316CVE-2017-7317CVE-2017-7615CVE-2017-8221CVE-2017-8222CVE-2017-8223CVE-2017-8224CVE-2017-8225CVE-2017-8835CVE-2017-8836CVE-2017-8837CVE-2017-8838CVE-2017-8839CVE-2017-8840CVE-2017-8841CVE-2017-8917CVE-2017-9964CVE-2017-9965CVE-2017-9966CVE-2018-17153CVE-2025-34043CVE-2025-34099
    Separate evidence group
    06

    Technical vulnerability data

    Context, not threat proof

    VTP threat score62.8vtp-threat-v1-public
    Public exploitation30 / 30
    EPSS prediction19.25 / 20
    Exploit availability7.5 / 15
    Source independence0 / 15
    Intelligence recency6 / 10
    Threat acceleration0 / 10
    CVSS technical severityExcluded
    CVSS
    8.1 · HIGH
    Vector
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    Unknown
    CPE records
    3
    Deterministic history records
    20
    Primary technical reference
    07

    Raw observations

    First-party sensor records

    First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.