Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2…
Priority CRITICAL 100Exploited in the wildCWE-326Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-326.
Summary
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Why it matters now
Exploitation Active In CISA KEV since 2022-04-11CISA due date 2022-05-02
EPSS 0.84175 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:telerik:ui_for_asp.net_ajax:*:*:*:*:*:*:*:* | up to 2016.3.1027 | Vulnerable | Telerik |
| cpe:2.3:a:telerik:ui_for_asp.net_ajax:2017.2.503:*:*:*:*:*:*:* | 2017.2.503 | Vulnerable | Telerik |
| cpe:2.3:a:telerik:ui_for_asp.net_ajax:2017.2.621:*:*:*:*:*:*:* | 2017.2.621 | Vulnerable | Telerik |
- cpe:2.3:a:telerik:ui_for_asp.net_ajax:*:*:*:*:*:*:*:* Versions up to 2016.3.1027 Vulnerable ·Telerik
- cpe:2.3:a:telerik:ui_for_asp.net_ajax:2017.2.503:*:*:*:*:*:*:* Versions 2017.2.503 Vulnerable ·Telerik
- cpe:2.3:a:telerik:ui_for_asp.net_ajax:2017.2.621:*:*:*:*:*:*:* Versions 2017.2.621 Vulnerable ·Telerik
Remediation
No fixed version listed by the sources yet.
Timeline
- 2022-04-11 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2017-11317
- 2026-10-03 Alias added: GHSA-9v96-j7x8-6wjv
References
More Telerik Ui For Asp.net Ajax vulnerabilities
- TI-2019-13651 Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization… KEVCVSS 3.1CRITICAL 9.8
- TI-2017-06690 Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2017-11317 · CVE Program
- CVE-2017-11317 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-9v96-j7x8-6wjv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences