CVE-2017-6884

CVE-2017-6884 is an OS command injection flaw (CWE-78) in the diagnostic tools of Zyxel EMG2926 routers, located in the nslookup function. An attacker can trigger it through multiple vectors, notably by supplying a malicious ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI, causing attacker-controlled commands to execute on the router. Successful exploitation yields arbitrary command execution on the gateway, providing a foothold that can be used for further network compromise, including by ransomware operators. Any operator of a Zyxel EMG2926 router is affected, and many of these gateways were deployed through internet service providers. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-09-18 with known ransomware use, and EPSS estimates a 36.8% probability of exploitation within 30 days (98th percentile).

What to do: Per CISA's required action, apply mitigations per Zyxel's instructions or discontinue use of the product if mitigations are unavailable. Check whether the router's management interface, including the expert/maintenance/diagnostic/nslookup endpoint, is reachable from the WAN or untrusted networks and restrict access to it; monitor devices for signs of command execution or ransomware-related activity. Fixed firmware versions were not specified in the available data, so consult Zyxel's advisory for the appropriate upgrade path.