CVE-2017-17562Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
Updated under an hour ago ()
Does this affect you?
It affects embedthis goahead and 1 other product. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Dec 10, 2021; federal agencies had to remediate by Jun 10, 2022. Treat that date as your deadline.
Do this next
Free account, 1 product
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.
- CVSS
- 8.1 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Added to CISA KEV Dec 10, 2021; federal remediation due Jun 10, 2022Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 96.26% (percentile 100)
- Assigned by
- mitre
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
embedthis goahead embedthis:goahead | before 3.6.5 | NVD |
oracle integrated_lights_out_manager oracle:integrated_lights_out_manager | 3.0; 4.0 | NVD |
References
- https://github.com/elttam/advisories/tree/master/CVE-2017-17562x-refsource-misc, broken-link, third-party-advisory
- http://www.securitytracker.com/id/1040702vdb-entry, x-refsource-sectrack, broken-link, third-party-advisory
- https://www.elttam.com.au/blog/goahead/x-refsource-misc, broken-link, exploit, patch, third-party-advisory
- https://www.exploit-db.com/exploits/43360/exploit, x-refsource-exploit-db, third-party-advisory, vdb-entry
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlx-refsource-confirm, patch, third-party-advisory
- https://github.com/embedthis/goahead/commit/6f786c123196eb622625a920d54048629a7caa74x-refsource-misc, broken-link, patch, third-party-advisory
- https://github.com/embedthis/goahead/issues/249x-refsource-misc, broken-link, issue-tracking, third-party-advisory
- https://www.exploit-db.com/exploits/43877/exploit, x-refsource-exploit-db, third-party-advisory, vdb-entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-17562us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.