CVE-2017-18371

EIP tracks 1 public exploit for CVE-2017-18371. PoCs published by Pedro Ribeiro <[email protected]>, including Metasploit module exploits/linux/http/trueonline_p660hn_v2_rce.

AI-analyzed exploit summary This Metasploit module exploits an authenticated command injection vulnerability in the TrueOnline / ZyXEL P660HN-T v2 router. It leverages default credentials to authenticate and inject commands via the log forwarding page, ultimately downloading and executing a MIPS payload via TFTP.

The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username supervisor and password zyad1234. These accounts can be used to login to the web interface, exploit authenticated command injections, and change router settings for malicious purposes.