CVE-2017-16524

HIGH

Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload

Title source: metasploit

Description

Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_upload.php' allows remote authenticated attackers to upload and execute arbitrary PHP code via a filename with a .php extension, which is then accessed via a direct request to the file in the upload/ directory. To authenticate for this attack, one can obtain web-interface credentials in cleartext by leveraging the existing Local File Read Vulnerability referenced as CVE-2015-8279, which allows remote attackers to read the web-interface credentials via a request for the cslog_export.php?path=/root/php_modules/lighttpd/sbin/userpw URI.

Exploits (3)

exploitdb WORKING POC
by 0xFFFFFF · rubywebappsphp
https://www.exploit-db.com/exploits/43138
nomisec WORKING POC 4 stars
by realistic-security · poc
https://github.com/realistic-security/CVE-2017-16524
metasploit WORKING POC GOOD
by Omar Mezrag <[email protected]>, Realistic Security, Algeria · rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/samsung_srv_1670d_upload_exec.rb

References (2)

Scores

CVSS v3 8.8
EPSS 0.7471
EPSS Percentile 98.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (1)
hanwhasecurity/web_viewer 1.0.0.193
Published Nov 06, 2017
Tracked Since Feb 18, 2026