60
CVE-2017-18368
KEV PoC ×3massUnauthenticated OS Command Injection in Zyxel/Billion TrueOnline Routers
CISA: Zyxel P660HN-T1A Routers Command Injection Vulnerability
CVSS 3.1
9.8 critical
EPSS
94%p100
Published
()
KEV added
AI analysis
CVE-2017-18368 is a critical (CVSS 9.8) unauthenticated OS command injection (CWE-78) in the Remote System Log forwarding function of Zyxel P660HN-T1A (v1 and v2) and Billion 5200W-T routers distributed by Thailand ISP TrueOnline. An unauthenticated attacker who can reach the router's web management interface sends a crafted remote_host parameter to the ViewLog.asp page, with no credentials or user interaction required. Successful injection executes arbitrary operating-system commands on the device, giving the attacker full control of the router (e.g., botnet recruitment, traffic/DNS manipulation, or pivoting into the subscriber's LAN). Only TrueOnline-issued units of these models are affected, meaning Thai broadband subscribers deployed with this CPE. The flaw is in CISA's KEV catalog (added 2023-08-07), carries a 94.4% EPSS (100th percentile), and related reporting shows IoT botnets (e.g., Gafgyt campaigns against End-of-Life Zyxel routers and multi-exploit campaigns like RondoDox) actively targeting such devices.
What to do: Update affected routers to the latest firmware available from Zyxel/Billion or via TrueOnline's ISP update process, noting these models are End-of-Life so hardware replacement is the durable fix. Until patched, restrict or disable WAN-side access to the router's web management interface (the flaw is reachable unauthenticated via ViewLog.asp) and audit devices for signs of botnet compromise. Per the CISA KEV required action, apply vendor mitigations or discontinue use of the product if mitigations are unavailable.
Affected
| Zyxel P660HN-T1A v1 | TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 (TrueOnline-distributed firmware; model listed broadly as affected by CISA) |
| Zyxel P660HN-T1A v2 | — |
| Billion 5200W-T | — |
Estimated exposure
mass≈1 million (order-of-magnitude estimate) TrueOnline-issued devices, of which thousands to tens of thousands expose the management interface to the internet at… — The affected P660HN-T1A/5200W-T models were standard-issue CPE distributed by TrueOnline, one of Thailand's largest fixed-broadband ISPs with a subscriber base plausibly in the millions, while public internet scans typically show only a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.
CISA Known Exploited Vulnerability
- Affected
- Zyxel P660HN-T1A Routers
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Due date
- Ransomware use
- Unknown
In the news10 stories
60
60
60
60
50
47
47
Home & Small Office Wireless Routers Exploited to Attack Gaming Servers
Unit 42 details an updated Gafgyt botnet variant exploiting Zyxel, Huawei, and Realtek router vulnerabilities to recruit devices for DoS attacks on gaming servers.
Unit 42 researchers identified an updated Gafgyt variant derived from the JenX botnet that combines three remote code execution exploits: CVE-2017-18368 (Zyxel P660HN-T1A), CVE-2017-17215 (Huawei HG532), and CVE-2014-8361 (Realtek RTL81XX chipset). Shodan scans show more than 32,000 wireless routers worldwide potentially vulnerable to these exploits. The exploits act as droppers, pulling architecture-specific binaries from a malicious server (185.172.110.224), and the botnet performs denial-of-service attacks against gaming servers, most notably Valve Source engine servers.
38
35