Read the docs
TI-2017-07148 Aliases CVE-2017-9765GHSA-h3gg-c3fx-2m67

Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48…

Priority MEDIUM 64CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via a large XML document, aka Devil's Ivy. NOTE: the large document would be blocked by many common web-server configurations on general-purpose computers.

Why it matters now

EPSS 0.42081 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 66

CPEVersionsRoleVendor
cpe:2.3:a:genivia:gsoap:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.2:*:*:*:*:*:*:*2.7.2VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.3:*:*:*:*:*:*:*2.7.3VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.4:*:*:*:*:*:*:*2.7.4VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.5:*:*:*:*:*:*:*2.7.5VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.6:*:*:*:*:*:*:*2.7.6VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.7:*:*:*:*:*:*:*2.7.7VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.8:*:*:*:*:*:*:*2.7.8VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.9:*:*:*:*:*:*:*2.7.9VulnerableGenivia
  • cpe:2.3:a:genivia:gsoap:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.3:*:*:*:*:*:*:* Versions 2.7.3 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.4:*:*:*:*:*:*:* Versions 2.7.4 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.5:*:*:*:*:*:*:* Versions 2.7.5 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.6:*:*:*:*:*:*:* Versions 2.7.6 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.7:*:*:*:*:*:*:* Versions 2.7.7 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.8:*:*:*:*:*:*:* Versions 2.7.8 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.9:*:*:*:*:*:*:* Versions 2.7.9 Vulnerable ·Genivia
Show 56 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:genivia:gsoap:2.7.10:*:*:*:*:*:*:*2.7.10VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.11:*:*:*:*:*:*:*2.7.11VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.12:*:*:*:*:*:*:*2.7.12VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.13:*:*:*:*:*:*:*2.7.13VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.14:*:*:*:*:*:*:*2.7.14VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.15:*:*:*:*:*:*:*2.7.15VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.16:*:*:*:*:*:*:*2.7.16VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.7.17:*:*:*:*:*:*:*2.7.17VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.0:*:*:*:*:*:*:*2.8.0VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.1:*:*:*:*:*:*:*2.8.1VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.2:*:*:*:*:*:*:*2.8.2VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.3:*:*:*:*:*:*:*2.8.3VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.4:*:*:*:*:*:*:*2.8.4VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.5:*:*:*:*:*:*:*2.8.5VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.6:*:*:*:*:*:*:*2.8.6VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.7:*:*:*:*:*:*:*2.8.7VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.8:*:*:*:*:*:*:*2.8.8VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.9:*:*:*:*:*:*:*2.8.9VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.10:*:*:*:*:*:*:*2.8.10VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.11:*:*:*:*:*:*:*2.8.11VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.12:*:*:*:*:*:*:*2.8.12VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.13:*:*:*:*:*:*:*2.8.13VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.14:*:*:*:*:*:*:*2.8.14VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.15:*:*:*:*:*:*:*2.8.15VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.16:*:*:*:*:*:*:*2.8.16VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.17:*:*:*:*:*:*:*2.8.17VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.18:*:*:*:*:*:*:*2.8.18VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.19:*:*:*:*:*:*:*2.8.19VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.20:*:*:*:*:*:*:*2.8.20VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.21:*:*:*:*:*:*:*2.8.21VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.22:*:*:*:*:*:*:*2.8.22VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.23:*:*:*:*:*:*:*2.8.23VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.24:*:*:*:*:*:*:*2.8.24VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.25:*:*:*:*:*:*:*2.8.25VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.26:*:*:*:*:*:*:*2.8.26VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.27:*:*:*:*:*:*:*2.8.27VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.28:*:*:*:*:*:*:*2.8.28VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.29:*:*:*:*:*:*:*2.8.29VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.30:*:*:*:*:*:*:*2.8.30VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.31:*:*:*:*:*:*:*2.8.31VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.32:*:*:*:*:*:*:*2.8.32VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.33:*:*:*:*:*:*:*2.8.33VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.34:*:*:*:*:*:*:*2.8.34VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.35:*:*:*:*:*:*:*2.8.35VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.36:*:*:*:*:*:*:*2.8.36VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.37:*:*:*:*:*:*:*2.8.37VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.38:*:*:*:*:*:*:*2.8.38VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.39:*:*:*:*:*:*:*2.8.39VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.40:*:*:*:*:*:*:*2.8.40VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.41:*:*:*:*:*:*:*2.8.41VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.42:*:*:*:*:*:*:*2.8.42VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.43:*:*:*:*:*:*:*2.8.43VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.44:*:*:*:*:*:*:*2.8.44VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.45:*:*:*:*:*:*:*2.8.45VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.46:*:*:*:*:*:*:*2.8.46VulnerableGenivia
cpe:2.3:a:genivia:gsoap:2.8.47:*:*:*:*:*:*:*2.8.47VulnerableGenivia
  • cpe:2.3:a:genivia:gsoap:2.7.10:*:*:*:*:*:*:* Versions 2.7.10 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.11:*:*:*:*:*:*:* Versions 2.7.11 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.12:*:*:*:*:*:*:* Versions 2.7.12 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.13:*:*:*:*:*:*:* Versions 2.7.13 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.14:*:*:*:*:*:*:* Versions 2.7.14 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.15:*:*:*:*:*:*:* Versions 2.7.15 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.16:*:*:*:*:*:*:* Versions 2.7.16 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.7.17:*:*:*:*:*:*:* Versions 2.7.17 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.1:*:*:*:*:*:*:* Versions 2.8.1 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.2:*:*:*:*:*:*:* Versions 2.8.2 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.3:*:*:*:*:*:*:* Versions 2.8.3 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.4:*:*:*:*:*:*:* Versions 2.8.4 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.5:*:*:*:*:*:*:* Versions 2.8.5 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.6:*:*:*:*:*:*:* Versions 2.8.6 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.7:*:*:*:*:*:*:* Versions 2.8.7 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.8:*:*:*:*:*:*:* Versions 2.8.8 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.9:*:*:*:*:*:*:* Versions 2.8.9 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.10:*:*:*:*:*:*:* Versions 2.8.10 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.11:*:*:*:*:*:*:* Versions 2.8.11 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.12:*:*:*:*:*:*:* Versions 2.8.12 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.13:*:*:*:*:*:*:* Versions 2.8.13 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.14:*:*:*:*:*:*:* Versions 2.8.14 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.15:*:*:*:*:*:*:* Versions 2.8.15 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.16:*:*:*:*:*:*:* Versions 2.8.16 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.17:*:*:*:*:*:*:* Versions 2.8.17 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.18:*:*:*:*:*:*:* Versions 2.8.18 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.19:*:*:*:*:*:*:* Versions 2.8.19 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.20:*:*:*:*:*:*:* Versions 2.8.20 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.21:*:*:*:*:*:*:* Versions 2.8.21 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.22:*:*:*:*:*:*:* Versions 2.8.22 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.23:*:*:*:*:*:*:* Versions 2.8.23 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.24:*:*:*:*:*:*:* Versions 2.8.24 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.25:*:*:*:*:*:*:* Versions 2.8.25 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.26:*:*:*:*:*:*:* Versions 2.8.26 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.27:*:*:*:*:*:*:* Versions 2.8.27 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.28:*:*:*:*:*:*:* Versions 2.8.28 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.29:*:*:*:*:*:*:* Versions 2.8.29 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.30:*:*:*:*:*:*:* Versions 2.8.30 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.31:*:*:*:*:*:*:* Versions 2.8.31 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.32:*:*:*:*:*:*:* Versions 2.8.32 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.33:*:*:*:*:*:*:* Versions 2.8.33 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.34:*:*:*:*:*:*:* Versions 2.8.34 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.35:*:*:*:*:*:*:* Versions 2.8.35 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.36:*:*:*:*:*:*:* Versions 2.8.36 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.37:*:*:*:*:*:*:* Versions 2.8.37 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.38:*:*:*:*:*:*:* Versions 2.8.38 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.39:*:*:*:*:*:*:* Versions 2.8.39 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.40:*:*:*:*:*:*:* Versions 2.8.40 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.41:*:*:*:*:*:*:* Versions 2.8.41 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.42:*:*:*:*:*:*:* Versions 2.8.42 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.43:*:*:*:*:*:*:* Versions 2.8.43 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.44:*:*:*:*:*:*:* Versions 2.8.44 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.45:*:*:*:*:*:*:* Versions 2.8.45 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.46:*:*:*:*:*:*:* Versions 2.8.46 Vulnerable ·Genivia
  • cpe:2.3:a:genivia:gsoap:2.8.47:*:*:*:*:*:*:* Versions 2.8.47 Vulnerable ·Genivia

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-9765
  2. 2026-10-03 Alias added: GHSA-h3gg-c3fx-2m67

References

Exploit 1

Advisory 4

Other 1

  • TI-2019-15408 Genivia gSOAP 2.8 - 'gSOAP' Path Traversal CVSS 4.0HIGH 8.7
  • TI-2020-10656 NULL pointer dereference in Genivia CVSS 3.1HIGH 7.5
  • TI-2020-10653 NULL pointer dereference in Genivia gSOAP CVSS 3.1HIGH 7.5
  • TI-2020-10654 Integer overflow in Genivia CVSS 3.1CRITICAL 9.8
  • TI-2021-04828 Integer overflow in Genivia CVSS 3.1CRITICAL 9.8
  • TI-2019-04909 Sricam IP CCTV cameras are vulnerable to denial of service via multiple incomplete HTTP… CVSS 3.0HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences