CVE-2017-14335: On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending
61
This week
HIGH 7.5REMOTEMITIGATEMITIGATEMITIGATE
CVE-2017-14335 is a high-severity flaw (CVSS 7.5) affecting hb7024xt firmware, hb7032xt firmware, hb7008t2 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change.
Why this priority
High severity
EPSS top 2%: very likely to be exploited
Public exploit reference
Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Verify at the official sourceNVD · CVE Program · Report a problem with this page Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2017-14335?
hb7024xt firmware: mitigate or apply the listed mitigation; hb7032xt firmware: mitigate or apply the listed mitigation; hb7008t2 firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2017-14335 being exploited?
CVE-2017-14335 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2017-14335 affect?
CVE-2017-14335 affects hb7024xt firmware, hb7032xt firmware, hb7008t2 firmware. Severity is high (CVSS 7.5). On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change.
How urgent is CVE-2017-14335?
Priority 61/100. High severity; EPSS top 2%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
PatchTheCVE