Skip to content
Fencer Vulns
critical 10.0

CVE-2017-3623 in the critical feed json

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC).

published 2017-04-24 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-12740

cvss
10.0
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
22.5%
EPSS 22.5% chance of exploitation in 30 days, percentile 97%
public exploits
1
Exploit-DB

Summary

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC). For supported versions that are affected see note. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Solaris. While the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Solaris. Note: CVE-2017-3623 is assigned for "Ebbisland". Solaris 10 systems which have had any Kernel patch installed after, or updated via patching tools since 2012-01-26 are not impacted. Also, any Solaris 10 system installed with Solaris 10 1/13 (Solaris 10 Update 11) are not vulnerable. Solaris 11 is not impacted by this issue. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Patch / fix

Timeline

  1. Published
  2. First public exploit (EDB-47888)

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

22.53% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-47888 EBBISLAND EBBSHAVE 6100-09-04-1441 - Remote Buffer Overflow remote, 2020-01-08

CVSS scores

assigned by version score vector
NVD 3.0 10.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Oracle Corporation Solaris Operating System

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.