CVE-2018-17317

FruityWifi (aka PatatasFritas/PatataWifi) 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the io_mode, ap_mode, io_action, io_in_iface, io_in_set, io_in_ip, io_in_mask, io_in_gw, io_out_iface, io_out_set, io_out_mask, io_out_gw, iface, or domain parameter to /www/script/config_iface.php, or the newSSID, hostapd_secure, hostapd_wpa_passphrase, or supplicant_ssid parameter to /www/page_config.php.

• CWE-78

• http://blog.51cto.com/010bjsoft/2175710Exploit, Third Party Advisory
• https://github.com/PatatasFritas/PatataWifi/issues/1Exploit, Third Party Advisory
• https://github.com/xtr4nge/FruityWifi/issues/276
• http://blog.51cto.com/010bjsoft/2175710Exploit, Third Party Advisory
• https://github.com/PatatasFritas/PatataWifi/issues/1Exploit, Third Party Advisory
• https://github.com/xtr4nge/FruityWifi/issues/276

Published

Sep 21, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17311On the RICOH MP C6503 Plus printer, HTML Injection and Store…
• CVE-2018-17312On the RICOH Aficio MP 301 printer, HTML Injection and Store…
• CVE-2018-17313On the RICOH MP C307 printer, HTML Injection and Stored XSS …
• CVE-2018-17314On the RICOH Aficio MP 305+ printer, HTML Injection and Stor…
• CVE-2018-17315On the RICOH MP C2003 printer, HTML Injection and Stored XSS…
• CVE-2018-17316On the RICOH MP C6003 printer, HTML Injection and Stored XSS…
• CVE-2018-1732IBM QRadar Advisor with Watson 1.14.0 discloses sensitive in…5.3
• CVE-2018-17320An issue was discovered in UCMS 1.4.6. aaddpost.php has stor…
• CVE-2018-17321An issue was discovered in SeaCMS 6.64. XSS exists in admin_…
• CVE-2018-17322Cross-site scripting (XSS) vulnerability in index.php/index/…
• CVE-2018-1733IBM QRadar SIEM 7.2 and 7.3 fails to adequately filter user-…5.3
• CVE-2018-17332An issue was discovered in libsvg2 through 2012-10-19. The s…