What’s Vulnerable › Vulnerabilities

CVE-2017-14335

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 27.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-09-12 · updated 2026-06-17
• Weakness: CWE-20

Description

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change.

Affected products

• Hbgk 7204Xr Firmware: all versions
• Hbgk 7208Xr Firmware: all versions
• Hbgk 7216Xr Firmware: all versions
• Hbgk Hb7004K Firmware: all versions
• Hbgk Hb7004Kh Firmware: all versions
• Hbgk Hb7008Kc Firmware: all versions
• Hbgk Hb7008Kce Firmware: all versions
• Hbgk Hb7008Kh Firmware: all versions
• Hbgk Hb7008Khe Firmware: all versions
• Hbgk Hb7008T2 Firmware: all versions
• Hbgk Hb7016Lc Firmware: all versions
• Hbgk Hb7016Lh Firmware: all versions
• Hbgk Hb7016T2 Firmware: all versions
• Hbgk Hb7024Xt Firmware: all versions
• Hbgk Hb7032Xt Firmware: all versions
• Hbgk Hb7108X3 Firmware: all versions
• Hbgk Hb7116X3 Firmware: all versions
• Hbgk Hb7204Kk Firmware: all versions
• Hbgk Hb7204Kl Firmware: all versions
• Hbgk Hb7204X Firmware: all versions
• Hbgk Hb7204Xt Firmware: all versions
• Hbgk Hb7208X3 Firmware: all versions
• Hbgk Hb7208X Firmware: all versions
• Hbgk Hb7208Xt Firmware: all versions
• Hbgk Hb7216X3 Firmware: all versions
• Hbgk Hb7216X Firmware: all versions
• Hbgk Hb7216Xt Firmware: all versions
• Hbgk Hb7904 Firmware: all versions
• Hbgk Hb7904X Firmware: all versions
• Hbgk Hb7908 Firmware: all versions

References

• https://blogs.securiteam.com/index.php/archives/3420
• https://blogs.securiteam.com/index.php/archives/3420

Get alerted when CVE-2017-14335 or the next vulnerability affects your stack