🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2017-17562

8.1

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Updated Sep 18, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~1 minutes

CVE-2017-17562 Scanner

CVE-2017-17562 scanner - Remote Code Execution (RCE) vulnerability in GoAhead Web Server

Used 3.4k times · 5.9k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →