CVE-2017-9024

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Secure Bytes Cisco Configuration Manager, as bundled in Secure Bytes Secure Cisco Auditor (SCA) 3.0, has a Directory Traversal issue in its TFTP Server, allowing attackers to read arbitrary files via ../ sequences in a pathname.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://hyp3rlinx.altervista.org/advisories/SECURE-AUDITOR-v3.0-DIRECTORY-TRAVERSAL.txtExploit, Third Party Advisory
https://www.exploit-db.com/exploits/42041/Exploit, Third Party Advisory, VDB Entry
http://hyp3rlinx.altervista.org/advisories/SECURE-AUDITOR-v3.0-DIRECTORY-TRAVERSAL.txtExploit, Third Party Advisory
https://www.exploit-db.com/exploits/42041/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: May 21, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-90256.5Heap buffer overflow in vshttpd (aka ioos) in HooToo Trip Mate 6 (TM6) firmware 2.000.030 and earlier allows remote unauthenticated attacker CVE-2017-90269.8Stack buffer overflow in vshttpd (aka ioos) in HooToo Trip Mate 6 (TM6) firmware 2.000.030 and earlier allows remote unauthenticated attacke CVE-2017-90307.5The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows a directory traversal attack that bypasses a uniqid CVE-2017-90319.8The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render CVE-2017-90326.1Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inje CVE-2017-90338.8Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack CVE-2017-90349.8Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code CVE-2017-90357.4Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted commu CVE-2017-90367.8Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows local users to gain privileges by leveraging an unrestricted quarantine direct CVE-2017-90376.1Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inje CVE-2017-90385.5GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF CVE-2017-90395.5GNU Binutils 2.28 allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file with many program headers