PatchTheCVECVE-2017-18001: Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key
CVE-2017-18001 is a critical-severity flaw (CVSS 9.8) affecting secure web gateway. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI.
Why this priority
- Critical severity
- EPSS top 3%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 14.1% (top 3%) |
| CISA exploited list | No |
| Weakness | CWE-306 |
| Published | 2017-12-31 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2017-18001?
secure web gateway: upgrade to newer than 11.8.0.27. Exact commands for each OS are on this page.
Is CVE-2017-18001 being exploited?
CVE-2017-18001 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2017-18001 affect?
CVE-2017-18001 affects secure web gateway. Severity is critical (CVSS 9.8). Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey
How urgent is CVE-2017-18001?
Priority 68/100. Critical severity; EPSS top 3%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2024-6398 MEDIUM 4.3 UPGRADE An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 all
- CVE-2024-3378 MEDIUM 4.3 UPGRADE A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic
- CVE-2023-4400 MEDIUM 6.2 UPGRADE A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.1
- CVE-2022-2310 CRITICAL 10.0 UPGRADE An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2
- CVE-2020-9363 HIGH 7.8 UPGRADE UPGRADE The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive