Read the docs
TI-2017-12833 Aliases CVE-2017-17562GHSA-q5wm-274q-f3v6

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI…

Priority CRITICAL 94Exploited in the wildPublished · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.

Why it matters now

Exploitation Active In CISA KEV since 2021-12-10CISA due date 2022-06-10
EPSS 0.97127 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*before 3.6.5VulnerableEmbedthis
cpe:2.3:a:oracle:integrated_lights_out_manager:3.0:*:*:*:*:*:*:*3.0VulnerableOracle
cpe:2.3:a:oracle:integrated_lights_out_manager:4.0:*:*:*:*:*:*:*4.0VulnerableOracle
  • cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:* Versions before 3.6.5 Vulnerable ·Embedthis
  • cpe:2.3:a:oracle:integrated_lights_out_manager:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:integrated_lights_out_manager:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Oracle

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2021-12-10 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2017-17562
  3. 2026-10-03 Alias added: GHSA-q5wm-274q-f3v6

References

Exploit 3

Patch 2

Advisory 2

  • TI-2019-03557 Use after free in EmbedThis CVSS 3.1CRITICAL 9.8
  • TI-2021-18771 An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. CVSS 3.1CRITICAL 9.8
  • TI-2017-03674 A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and… CVSS 3.0CRITICAL 9.8
  • TI-2019-03558 Infinite loop in EmbedThis CVSS 3.1HIGH 7.5
  • TI-2014-07892 EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting… CVSS 2.0HIGH 7.5
  • TI-2017-14680 EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in… CVSS 3.0CRITICAL 9.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences