Skip to main content

CVE-2017-20217

| EUVD-2017-18928 HIGH
Missing Authentication for Critical Function (CWE-306)
2026-03-15 VulnCheck
Authentication Bypass Information Disclosure
8.7
CVSS 4.0
Share

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
CVSS changed
Apr 15, 2026 - 15:22 NVD
7.5 (HIGH) 8.7 (HIGH)
PoC Detected
Mar 16, 2026 - 14:53 vuln.today
Public exploit code
EUVD ID Assigned
Mar 15, 2026 - 20:00 euvd
EUVD-2017-18928
Analysis Generated
Mar 15, 2026 - 20:00 vuln.today
CVE Published
Mar 15, 2026 - 18:34 nvd
HIGH 7.5

DescriptionNVD

Serviio PRO 1.8 contains an information disclosure vulnerability due to improper access control enforcement in the Configuration REST API that allows unauthenticated attackers to access sensitive information. Remote attackers can send specially crafted requests to the REST API endpoints to retrieve potentially sensitive configuration data without authentication.

AnalysisAI

An information disclosure vulnerability in Serviio PRO 1.8 and earlier versions allows unauthenticated remote attackers to retrieve sensitive configuration data through the Configuration REST API due to missing authentication controls. Multiple public exploits are available, with proof-of-concept code published on Exploit-DB and PacketStorm, making this vulnerability easily exploitable by attackers with no special privileges or user interaction required.

Technical ContextAI

Serviio PRO is a media streaming server software that implements a REST API for configuration management. The vulnerability stems from CWE-306 (Missing Authentication for Critical Function), where the REST API endpoints fail to enforce authentication checks before serving configuration data. The affected versions include Serviio PRO 1.6.1, 1.7.0, 1.7.1, and 1.8.0.0 PRO as identified by CPE cpe:2.3:a:serviio:serviio_pro:*:*:*:*:*:*:*:*. The REST API, designed for administrative configuration, inadvertently exposes sensitive server settings to any network-accessible attacker.

RemediationAI

Upgrade to Serviio PRO version newer than 1.8.0.0 if available. As an immediate workaround, restrict network access to the Serviio PRO REST API using firewall rules or access control lists to limit exposure to trusted networks only. Consider implementing a reverse proxy with authentication in front of the Serviio service. Monitor for unauthorized access attempts to REST API endpoints. The ZeroScience advisory (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5404.php) may contain additional vendor-specific guidance.

Share

CVE-2017-20217 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy