CVE-2017-6900

An issue was discovered in Riello NetMan 204 14-2 and 15-2. The issue is with the login script and wrongpass Python script used for authentication. When calling wrongpass, the variables $VAL0 and $VAL1 should be enclosed in quotes to prevent the potential for Bash command injection. Further to this, VAL0 and VAL1 should be sanitised to ensure they do not contain malicious characters. Passing it the username of '-' will cause it to time out and log the user in because of poor error handling. This will log the attacker in as an administrator where the telnet / ssh services can be enabled, and the credentials for local users can be reset. Also, login.cgi accepts the username as a GET parameter, so login can be achieved by browsing to the /cgi-bin/login.cgi?username=-%20a URI.

• CWE-255

• https://blog.synack.co.uk/2017/01/31/my-first-exploit-db-post/Broken Link
• https://web.archive.org/web/20170205100702/https://blog.synack.co.uk/2017/01/31/my-first-exploit-db-post/Third Party Advisory
• https://blog.synack.co.uk/2017/01/31/my-first-exploit-db-post/Broken Link
• https://web.archive.org/web/20170205100702/https://blog.synack.co.uk/2017/01/31/my-first-exploit-db-post/Third Party Advisory

Published

Jul 3, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6891Two errors in the "asn1_find_node()" function (lib/parser_au…8.8
• CVE-2017-6892In libsndfile version 1.0.28, an error in the "aiff_read_cha…
• CVE-2017-6894A vulnerability exists in FlexNet Manager Suite releases 201…7.8
• CVE-2017-6895USB Pratirodh allows remote attackers to conduct XML Externa…
• CVE-2017-6896Privilege escalation vulnerability on the DIGISOL DG-HR1400 …
• CVE-2017-6899The msm_bus_dbg_update_request_write function in drivers/pla…
• CVE-2017-6902Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-6903In ioquake3 before 2017-03-14, the auto-downloading feature …
• CVE-2017-6905An issue was discovered in concrete5 <= 5.6.3.4. The vulnera…
• CVE-2017-6906An issue was discovered in SiberianCMS before 4.10.0. The v…
• CVE-2017-6907An issue was discovered in Open.GL before 2017-03-13. The vu…
• CVE-2017-6908An issue was discovered in concrete5 <= 5.6.3.4. The vulnera…