Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger fiel…

published 2018-01-04 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-9014

cvss: 8.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 11.1%; EPSS 11.1% chance of exploitation in 30 days, percentile 95%
public exploits: 1; Exploit-DB

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the /etc/uci-defaults directory was not being used to secure the OpenWrt configuration.

Timeline

2017-12-23 First public exploit (EDB-43428)
2018-01-04 Published

Exploit prediction

11.07% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-43428 Iopsys Router - 'dhcp' Remote Code Execution remote, 2017-12-23
neonsea.uk https://neonsea.uk/blog/2017/12/23/rce-inteno-iopsys.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	9.0	AV:N/AC:L/Au:S/C:C/I:C/A:C

Classification

Weakness

CWE-732 Incorrect Permission Assignment for Critical Resource

References

exploit-db.com /exploits/43428/
exploit, third-party-advisory, vdb-entry
neonsea.uk /blog/2017/12/23/rce-inteno-iopsys.html
exploit, technical-description, third-party-advisory
public.inteno.se /?p=feed-inteno-openwrt.git%3Ba=commit%3Bh=efcc985a721107e72a66da4db66891ec54441998

Sources

CVE List CVE-2017-17867
NVD CVE-2017-17867

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary