8.1

CVE-2017-17562: Embedthis GoAhead Remote Code Execution Vulnerability

CVSS: 8.1v3.1HighKEVAnalyzed
Published 12-12-2017Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2017-17562 is a high (CVSS 8.1) vulnerability in Embedthis GoAhead. It is known to be exploited: CISA lists it, first on 10-12-2021. EPSS estimates a 97.13% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (CVE.org)
EPSS score
97.13%
0%100%
Critical · +0.86 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits4reference, exploit-database, metasploit

Timeline

  1. 12-12-2017
    PublishedVulnerability first disclosed.
  2. 10-12-2021
    Added to CISA KEVEmbedthis GoAhead Remote Code Execution Vulnerability
  3. 10-06-2022
    CISA remediation dueApply updates per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

97.13%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+0.86 pp

From 96.26% on 19-09-2026

19-09-202619-10-2026
EPSS score
97.13%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
10-12-2021
Federal due date
10-06-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2017-17562

Public exploits

4 found
  • referenceUnverified

    Exploit Reference (elttam.com.au)

    Maturity: unknown

  • exploit-databaseremotelinuxVerified

    GoAhead Web Server 2.5 < 3.6.5 - HTTPd 'LD_PRELOAD' Remote Code Execution

    Maturity: weaponized

  • exploit-databaseremotemultipleVerified

    GoAhead Web Server 2.5 < 3.6.5 - HTTPd 'LD_PRELOAD' Arbitrary Module Load (Metasploit)

    Maturity: weaponized

Show all 4 exploits
  • MetasploitMetasploitremoteVerified

    GoAhead Web Server LD_PRELOAD Arbitrary Module Load

    exploit/linux/http/goahead_ldpreload

    Maturity: weaponized

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Embedthis1 product
Oracle1 product

2 vendors · 2 products

References

9 links