High severity8.8NVD Advisory· Published Jan 5, 2018· Updated Jun 17, 2026

CVE-2017-16666

Description

Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name of an uploaded PCAP file. NOTE: this issue can be exploited without authentication by leveraging the user registration feature.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Xplico/Xplicoinferred3 versions
<1.2.1+ 2 more
- (no CPE)range: <1.2.1
- cpe:2.3:a:xplico:xplico:*:*:*:*:*:*:*:*range: <1.2.1
- (no CPE)range: <1.2.1

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/145639/Xplico-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
www.rapid7.com/db/modules/exploit/linux/http/xplico_execnvdExploitThird Party Advisory
pentest.blog/advisory-xplico-unauthenticated-remote-code-execution-cve-2017-16666/nvdExploitThird Party Advisory
www.exploit-db.com/exploits/43430/nvdExploitThird Party AdvisoryVDB Entry
blog.securityonion.net/2017/11/security-advisory-for-xplico-120.htmlnvdThird Party Advisory
www.xplico.org/archives/1538nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.064
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000