Vulnerability Report

CVE-2017-9640

Title: Carrier Automatedlogic Webctrl Path Traversal / LFI

Arbitrary File Access

Proof Of Concept

PoC Available for CVE-2017-9640

CWE Category CWE-22

Published Date Aug 25, 2017

Modified Date Jun 17, 2026

Exploit Status Available

Score 6.3 CVSS v3.0

Exploit Probability (EPSS)

8.45%

Vulnerability Summary

CVE-2017-9640: A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to overwrite files that are used to execute code. This vulnerability does not affect version 6.5 of the software.

Impacted Vendors

carrier 1

automatedlogic 2

Reference Links

http://www.securityfocus.com/bid/100452 https://ics-cert.us-cert.gov/advisories/ICSA-17-234-01 https://www.exploit-db.com/exploits/42543/ http://www.securityfocus.com/bid/100452 https://ics-cert.us-cert.gov/advisories/ICSA-17-234-01 https://www.exploit-db.com/exploits/42543/

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

6.3

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

6.5

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:S/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns