10

CVE-2017-18001: trustwave secure_web_gateway

CVSS: 10.0v2.0HighModified
Published 31-12-2017Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2017-18001 is a high (CVSS 10.0) vulnerability in trustwave secure_web_gateway. EPSS estimates a 14.08% chance of exploitation in the next 30 days, higher than 96.5% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
High · v2.0 (NVD)
EPSS score
14.08%
0%100%
Medium · +0.26 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3reference, exploit-database

Timeline

  1. 31-12-2017
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI.

CVSS metrics

2 scores · 1 source · 2 versions

EPSS trend

Probability

14.08%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

+0.26 pp

From 13.82% on 18-09-2026

18-09-202618-10-2026
EPSS score
14.08%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (seclists.org)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (blogs.securiteam.com)

    Maturity: unknown

  • exploit-databaseremotelinuxUnverified

    Trustwave SWG 11.8.0.27 - SSH Unauthorized Access

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Trustwave1 product

1 vendor · 1 product

References

4 links