Skip to content
Fencer Vulns
critical 9.8

CVE-2017-17097 json

gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthentic…

published 2018-01-02 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-8263

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
6.9%
EPSS 6.9% chance of exploitation in 30 days, percentile 94%
public exploits
1
Exploit-DB

Summary

gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php.

Patch / fix

Timeline

  1. Published
  2. First public exploit (EDB-43431)

Exploit prediction

6.95% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-43431 gps-server.net GPS Tracking Software < 3.1 - Multiple Vulnerabilities webapps, 2018-01-05

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.