CVE-2017-9650

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to upload a malicious file allowing the execution of arbitrary code.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	Automated Logic Corporation WebCTRL, i-VU, SiteScan	Automated Logic Corporation WebCTRL, i-VU, SiteScan

References

http://www.securityfocus.com/bid/100452Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-234-01Mitigation, Third Party Advisory, US Government Resource
https://www.exploit-db.com/exploits/42544/Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/100452Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-234-01Mitigation, Third Party Advisory, US Government Resource
https://www.exploit-db.com/exploits/42544/Third Party Advisory, VDB Entry

Timeline

Published: Aug 25, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-96539.8An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft A CVE-2017-96548.8The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear text within backend sy CVE-2017-96555.4A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azur CVE-2017-96569.1The backend database of the Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069 uses hard-coded credentials for a database CVE-2017-96576.5Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the centra CVE-2017-96586.5Certain 802.11 network management messages have been determined to invoke wireless access point blacklisting security defenses when not requ CVE-2017-96598.8A Stack-Based Buffer Overflow issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. The stack-based buff CVE-2017-96608.8A Heap-Based Buffer Overflow was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. A heap-based buffer overflo CVE-2017-96617.0An Uncontrolled Search Path Element issue was discovered in SIMPlight SCADA Software version 4.3.0.27 and prior. The uncontrolled search pat CVE-2017-96625.3An Improper Privilege Management issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. Monitouch V-SFT i CVE-2017-96637.5An Cleartext Storage of Sensitive Information issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Succ CVE-2017-96649.8In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker