ZeroDay Findings
Sign inSign up

Findings

CVE-2017-18368

Zyxel P660HN-T1A Routers Command Injection Vulnerability

Published May 2, 2019 · updated Jun 16, 2026 · billion 5200w-t firmware

The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.

Timeline

Detection, updates, and resolution for this record.

  1. May 2, 2019 · Catalog

    Detected

    The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.

  2. Aug 7, 2023 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Aug 28, 2023 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Aug 28, 2023

Affected

  • cpe billion/5200w-t firmware7.3.8.0
  • cpe zyxel/p660hn-t1a v1 firmware7.3.15.0
  • cpe zyxel/p660hn-t1a v2 firmware7.3.15.0
  • vendor Zyxel P660HN-T1A Routersversion unspecified

Sources

  • CISA KEVCVE-2017-18368

    Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.

    cisa.gov
  • CVE.orgCVE-2017-18368

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2017-18368

    30-day exploitation probability 94.4%

    first.org
  • Metasploit Modulesexploit_linux/http/trueonline_p660hn_v1_rce

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2017-18368

    The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and

    nvd.nist.gov

References