CVE-2017-16544

mediumPriorität · verfolgen · 37EPSS 0.061 · 93. PerzentilDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
6.14% (93rd) EPSS
CVSS 6.5 · medium
Is it mine?
45 products
Prüfe deine Angriffsfläche
Who says so?
7 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-23

In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobenwago_psirt

    Update your managed switch to the latest firmware: 852-303 (>= V1.2.2.S0) 852-1305 (>= V1.1.6.S0) 852-1505 (>= V1.1.5.S0) Firmwares published on Jun 7, 2019 or later are fixed. Please refer to the corresponding manual.

  • Mitigationphoenix_contact_psirt

    The pre-installed generic X.509 certificate should be renewed or replaced by an individual certificate during initial configuration. For details on replacing this certificate please refer to the user manual on page 51 et seq. Press 'renew' to create a new self-signed device certificate or upload a user specific certificate with the upload dialog. To avoid the manual generation of an individual certificate, the devices will be shipped with individual certificates starting with a future release.

  • MitigationN-Tron 702-Wcisa_csaf_ot

    Red Lion's 702-W Series was discontinued in 2018 and cannot be updated. Red Lion recommends these products be used locally within a secure network.

  • MitigationN-Tron 702M12-Wcisa_csaf_ot

    Red Lion's 702-W Series was discontinued in 2018 and cannot be updated. Red Lion recommends these products be used locally within a secure network.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.5–8.8

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 8 · Auswirkung 6.4
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 5.9
v3.08.8highCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Phoenix Contact PSIRT DE
v3.08.8highCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · WAGO PSIRT DE
v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.18.8highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HsecondaryAusnutzbarkeit 2.8 · Auswirkung 5.9
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-94USprimärCWE-1104USCWE-94USCWE-94USCWE-94US
05

betroffene Produkte (45)

Betroffene Produkte und Versionsbereiche.

20 von 45 angezeigt
06

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

  • VDE-2019-013WAGO: Multiple Vulnerabilities in industrial managed switches2019-06-12csaf · wago_psirtDE

    Multiple vulnerabilities have been identified in WAGO 852-303, 852-1305 and 852-1505 industrial managed ethernet switches.

  • VDE-2020-003PHOENIX CONTACT: TC Router and TC Cloud Client multiple vulnerabilities2020-03-05csaf · phoenix_contact_psirtDE

    Multiple Vulnerabilities exist in components used by the aforementioned products. See CVE-Details for more information.

  • ICSA-20-240-01Red Lion N-Tron 702-W, 702M12-W2020-08-27icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to sensitive information, execute system commands, and perform actions in the context of an attacked user.

07

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducisa_csaf_otnvdwago_psirtphoenix_contact_psirtNVDCVE.orgMITRE
veröffentlicht 2017-11-20geändert 2026-09-09
10

Referenzen (69)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan